security: replace dill.load() with SafeUnpickler allowlist in mmv/utils/checkpoint.py

[brodmart]

Summary

mmv/utils/checkpoint.py:24 calls dill.load() on an attacker-controlled file path (--checkpoint_path flag). dill is a superset of pickle and executes arbitrary Python bytecode during deserialization — a malicious checkpoint achieves full RCE on the loading host with no further prerequisites.

# Before (line 24) — arbitrary code execution
checkpoint_data = dill.load(checkpoint_file)

Fix

Replace dill.load() with _SafeUnpickler, a stdlib pickle.Unpickler subclass that overrides find_class() with an explicit allowlist. Only types actually present in MMV parameter/state dicts are permitted:

• numpy.ndarray, numpy.dtype, numpy scalar/reconstruct helpers
• builtins: dict, list, tuple, str, int, float, bool, bytes

Any type outside the allowlist raises pickle.UnpicklingError before instantiation.

# After — allowlist-gated deserialization
checkpoint_data = _SafeUnpickler(checkpoint_file).load()

This also removes the dill dependency from the mmv module entirely.

Impact

CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — 7.8 HIGH

A user who runs eval_ucf101.py --checkpoint_path <attacker-controlled-path> loads and executes the malicious payload. Typical in shared compute environments (university clusters, cloud notebooks) where checkpoint files are shared between users.

Testing

The allowlist covers all types written by the original MMV checkpoint-saving code. If any additional numpy or JAX types are encountered, extend _SafeUnpickler._ALLOWED accordingly — the error message names the blocked module.class for easy diagnosis.

[polarbe]

Dooray! 메일 발송 실패 안내 메일 발송 실패 안내 ***@***.***) 님께 보낸 메일이 전송되지 못하였습니다. 실패 사유를 확인해보세요. * 받는 사람 :  ***@***.***) * 발송 시간 :  2026-05-01T02:47:04 * 메일 제목 :  [google-deepmind/deepmind-research] security: replace dill.load() with SafeUnpickler allowlist in mmv/utils/checkpoint.py (PR #716) * 실패 사유 :  받는 사람이 현재 메일 수신을 제한하고 있습니다. 이 설정은 개인 또는 조직의 메일 수신 정책에 의해 적용되었습니다. 이 메일은 발신전용으로 회신되지 않습니다. 더 궁금하신 사항은 ***@***.*** 으로 문의해 주시기 바랍니다. © Dooray!.