Summary
Xorbits Xoscar through version 0.11.2 contains an unauthenticated unsafe deserialization vulnerability in its actor-pool TCP communication path. A remote attacker may send crafted data that is deserialized before message validation, potentially enabling arbitrary code execution with the privileges of the server process.
Xorbits Xoscar through version 0.11.2 contains an unauthenticated unsafe deserialization vulnerability in its actor-pool TCP communication path. A remote attacker may send crafted data that is deserialized before message validation, potentially enabling arbitrary code execution with the privileges of the server process.
Affected context
The vulnerability occurs in Xoscar deployments that expose the actor-pool TCP channel and use the affected SocketChannel message-receiving flow. Risk is highest when the channel is reachable by untrusted networks and the service process has elevated privileges, such as on GPU or cluster nodes.
The vulnerability occurs in Xoscar deployments that expose the actor-pool TCP channel and use the affected SocketChannel message-receiving flow. Risk is highest when the channel is reachable by untrusted networks and the service process has elevated privileges, such as on GPU or cluster nodes.
Exploit preconditions
- Attack surface: The actor-pool TCP communication channel
- Required access: Network connectivity to the exposed channel; authentication is not required according to the vulnerability description
- Trigger point: Receipt and processing of serialized data by
SocketChannel.recv() - Why exploitation is possible: Unvalidated data reaches
cloudpickle.loads()before message type validation, allowing deserialization behavior to occur before the application confirms that the message is trusted or structurally valid
- Attack surface: The actor-pool TCP communication channel
- Required access: Network connectivity to the exposed channel; authentication is not required according to the vulnerability description
- Trigger point: Receipt and processing of serialized data by
SocketChannel.recv() - Why exploitation is possible: Unvalidated data reaches
cloudpickle.loads()before message type validation, allowing deserialization behavior to occur before the application confirms that the message is trusted or structurally valid
Why this happens
The underlying bug is unsafe deserialization of attacker-influenced data. The communication layer passes received bytes directly to a powerful serialization mechanism, and deserialization occurs before message validation. Because pickle-compatible serialization can invoke object reconstruction behavior, including __reduce__-based gadget logic, untrusted input may be treated as executable behavior. This maps to CWE-502: Deserialization of Untrusted Data.
The underlying bug is unsafe deserialization of attacker-influenced data. The communication layer passes received bytes directly to a powerful serialization mechanism, and deserialization occurs before message validation. Because pickle-compatible serialization can invoke object reconstruction behavior, including __reduce__-based gadget logic, untrusted input may be treated as executable behavior. This maps to CWE-502: Deserialization of Untrusted Data.
Potential impact
- An attacker may execute arbitrary code in the Xoscar server process
- The compromised process could expose or alter data handled by the actor pool
- Attackers could establish persistence or use the node for further attacks
- A process running with root or other elevated privileges could increase the scope of compromise
- GPU or cluster workloads may be disrupted, manipulated, or used for lateral movement
- An attacker may execute arbitrary code in the Xoscar server process
- The compromised process could expose or alter data handled by the actor pool
- Attackers could establish persistence or use the node for further attacks
- A process running with root or other elevated privileges could increase the scope of compromise
- GPU or cluster workloads may be disrupted, manipulated, or used for lateral movement
General mitigation guidance
Mitigation generally focuses on removing unsafe deserialization from unauthenticated network paths and reducing the trust placed in serialized messages.
Common defensive patterns include:
- Prefer data formats that do not support executable object reconstruction
- Use narrowly scoped, allowlisted serializers when object serialization is required
- Authenticate and authorize actor-pool connections before accepting application data
- Validate message framing, type, size, and schema before invoking any decoder
- Restrict network exposure with segmentation, firewall rules, and private interfaces
- Run worker and server processes with the minimum required operating-system privileges
- Apply container, node, and workload isolation to limit the impact of process compromise
Mitigation generally focuses on removing unsafe deserialization from unauthenticated network paths and reducing the trust placed in serialized messages.
Common defensive patterns include:
- Prefer data formats that do not support executable object reconstruction
- Use narrowly scoped, allowlisted serializers when object serialization is required
- Authenticate and authorize actor-pool connections before accepting application data
- Validate message framing, type, size, and schema before invoking any decoder
- Restrict network exposure with segmentation, firewall rules, and private interfaces
- Run worker and server processes with the minimum required operating-system privileges
- Apply container, node, and workload isolation to limit the impact of process compromise
How teams detect issues like this
Detection can combine code analysis, runtime monitoring, and network policy review:
- Use static analysis to identify
pickle,cloudpickle, or equivalent deserialization of socket-derived data - Review code paths where decoding occurs before authentication, authorization, or message validation
- Flag unrestricted deserialization APIs and dynamically reconstructed object types during code review
- Monitor actor-pool endpoints for unexpected internet exposure, unauthenticated connections, and abnormal message volume
- Enforce repository and deployment policies that prohibit unsafe serializers on untrusted network inputs
- Use automated security review tools to detect CWE-502 patterns and privilege-related exposure
Detection can combine code analysis, runtime monitoring, and network policy review:
- Use static analysis to identify
pickle,cloudpickle, or equivalent deserialization of socket-derived data - Review code paths where decoding occurs before authentication, authorization, or message validation
- Flag unrestricted deserialization APIs and dynamically reconstructed object types during code review
- Monitor actor-pool endpoints for unexpected internet exposure, unauthenticated connections, and abnormal message volume
- Enforce repository and deployment policies that prohibit unsafe serializers on untrusted network inputs
- Use automated security review tools to detect CWE-502 patterns and privilege-related exposure
