| # PoC — NeMo `setup_model()` target-allowlist bypass |
| |
| `malicious_target_bypass.nemo` is an uncompressed tar archive (`tarfile.open(mode="w:")`, the |
| same mode NeMo itself uses to write `.nemo` files) containing: |
| |
| - `model_config.yaml` — a minimal config whose top-level `target` field is |
| `subprocess.Popen`, a class completely unrelated to any NeMo model and **not** present in |
| `nemo.core.classes.common.ALLOWED_TARGET_PREFIXES`. |
| - `model_weights.ckpt` — a placeholder (not a real PyTorch checkpoint); it is never reached in |
| this specific demonstration because `subprocess.Popen` has no `.restore_from()`. |
|
|
| ## How this is meant to be used |
|
|
| ``` |
| python examples/asr/transcribe_speech.py model_path=malicious_target_bypass.nemo audio_dir=<any> |
| ``` |
|
|
| Expected effect, per the vulnerability described in the accompanying `SUBMISSION.md`: |
|
|
| 1. `setup_model()` (`nemo/collections/asr/parts/utils/transcribe_utils.py:315-344`) calls |
| `ASRModel.restore_from(restore_path=model_path, return_config=True)`, which extracts and |
| parses `model_config.yaml` **without** ever calling `_is_target_allowed()` / |
| `safe_instantiate()`. |
| 2. `classpath = model_cfg.target` → `"subprocess.Popen"`. |
| 3. `model_utils.import_class_by_path("subprocess.Popen")` succeeds — this is the raw, |
| unprotected function; it imports `subprocess` and resolves `Popen` with no allowlist check |
| at all. |
| 4. `subprocess.Popen.restore_from(restore_path=..., map_location=...)` is then attempted and |
| raises `AttributeError` (`Popen` has no `restore_from`), so the process crashes at this |
| point. |
|
|
| The crash on step 4 is the **intentionally non-destructive, minimum-guaranteed** demonstration: |
| it proves the import of an arbitrary, attacker-chosen, out-of-allowlist class already happened |
| (step 3) before anything fails. Swapping `subprocess.Popen` for a module with dangerous |
| import-time side effects, or for a compatible internal NeMo model class, changes the outcome |
| without changing the underlying bug. |
|
|
| ## Caveat — not run end-to-end against a live NeMo installation |
|
|
| The exact bypass mechanism (`import_class_by_path()` accepting `"subprocess.Popen"` while |
| `_is_target_allowed()` rejects it) **was** empirically verified by importing and calling the |
| real, unmodified functions from this commit's `nemo/utils/model_utils.py` and |
| `nemo/core/classes/common.py` directly (see `attachments/poc_allowlist_bypass.py` + |
| `attachments/run_output.txt` in the main submission folder). |
|
|
| What was **not** independently re-verified is running `transcribe_speech.py` end-to-end against |
| this exact `.nemo` file inside a full NeMo installation (setting up the complete pinned |
| dependency stack — `lightning`, `nv_one_logger*`, `megatron-core`, etc. — proved impractical in |
| the available verification environment due to unrelated third-party version incompatibilities |
| in the `nv_one_logger` / `lightning` integration layer, not to anything about this bug). The |
| static trace of `setup_model()` → `restore_from(..., return_config=True)` → |
| `load_config_and_state_dict()` (`nemo/core/connectors/save_restore_connector.py:98-202`) was |
| read in full and is quoted in the submission; only the live end-to-end run was not reproduced. |
|
|
| If it does not reproduce cleanly against a specific NeMo install, the standalone function-level |
| PoC remains valid, verified, independent evidence of the root-cause bug regardless. |
|
|
