CVE-2024-3568

The vulnerability results from the use of the `pickle.load()` function in the `load_repo_checkpoint()` method of the `TFPreTrainedModel` class to deserialize data from potentially untrusted sources. An attacker prepares a malicious serialized payload and places it in a checkpoint file that looks like a normal model state save. When the victim loads such a checkpoint during a standard model training process, the embedded payload is deserialized and executed by the Python interpreter with the victim's process privileges.

An attacker can execute arbitrary code and system commands on the victim's machine (RCE), which consequently can lead to complete system takeover, data theft, or malware installation.

The Huggingface Transformers library should be updated to a version containing the fix commit 693667b8ac8138b83f8adb6522ddaf42fa07c125. Additionally, it is recommended to load checkpoints only from trusted and verified sources and to avoid deserializing data from unknown origins.

Huggingface Transformers library — specific vulnerable versions indicated in the vendor references (fix commit: 693667b8ac8138b83f8adb6522ddaf42fa07c125)