GHSA-3x5x-fw77-g54c dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()
Attackers can execute arbitrary code remotely by sending malicious pickle data to the DGL RPC server, affecting distributed training clusters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-3x5x-fw77-g54c?
GHSA-3x5x-fw77-g54c is an unsafe deserialization vulnerability in dgl, published on 5 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Dgl implements rpc server (start_server() in rpc_server.py) for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be used for remote code execution.
Patches
TBD.
Workarounds
When running DGL distributed training and inference (DistDGL) make sure you do not assign public IPs to any instance in the cluster.
References
Issue #7874
Reported by
Pinji Chen ([email protected]) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University
Which versions are affected by GHSA-3x5x-fw77-g54c?
2 open source packages ship an affected version, including dgl.
| Package | Affected | Fixed in |
|---|---|---|
dgl PyPI | All versions to 2.4.0 | None |
dgl PyPI | All versions to 2.4.0 | None |
How do I fix GHSA-3x5x-fw77-g54c?
No fix has been published for GHSA-3x5x-fw77-g54c yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-3x5x-fw77-g54c being exploited?
There is no known exploitation of GHSA-3x5x-fw77-g54c in the wild and no public exploit code.