| # Tensorizer torch_compat default torch.load RCE |
| |
| This PoC shows that `tensorizer.torch_compat.tensorizer_loading()` changes the behavior of `torch.load(path)` in a way that bypasses the current PyTorch default `weights_only=True` protection. |
|
|
| The malicious file is generated through the Tensorizer compatibility workflow: |
|
|
| 1. `tensorizer_saving()` wraps `torch.save()`. |
| 2. `torch.save()` writes Tensorizer-compatible metadata to `tensorizer_torchcompat_default_rce.pt`. |
| 3. Tensorizer also creates the sidecar file `tensorizer_torchcompat_default_rce.pt.tensors`. |
| 4. Loading the same file through `tensorizer_loading()` and plain `torch.load(path)` executes the malicious pickle payload. |
|
|
| Run: |
|
|
| ```bash |
| python build_and_verify.py |
| ``` |
|
|
| Expected result: |
|
|
| - `torch_load_default_poc`: blocked by PyTorch's default weights-only guard. |
| - `tensorizer_loading_default_poc`: marker file is created. |
| - `tensorizer_loading_weights_only_true_poc`: blocked because explicit `weights_only=True` is incompatible with a custom pickle module. |
|
|
| This was tested locally only. |
|
|
