Incident Overview
On January 23, 2025, Oligo Security disclosed a critical vulnerability, CVE-2024-50050, affecting Meta’s Llama Stack inference server. The flaw allowed remote code execution (RCE) on the host system by exploiting unsafe deserialization of network input using Python’s pickle module. This vulnerability extended a known issue with pickle usage from model files to model-serving protocols, enabling attackers to execute arbitrary code on inference hosts. The issue was confirmed by Meta and patched in October 2024 by switching to JSON for data serialization, mitigating the risk of arbitrary code execution.
The vulnerability specifically impacted the default Meta Reference implementation of the Llama Stack inference server, which relied on the pyzmq library for inter-process communication. The recv_pyobj method in pyzmq was used to deserialize Python objects received over a ZeroMQ socket, automatically invoking pickle.loads. Since the socket was exposed to untrusted network input, attackers could craft malicious pickled objects to trigger arbitrary code execution during deserialization. This design flaw was not unique to Llama Stack; similar issues have been documented in other open-source AI frameworks due to unsafe use of pickle with untrusted data sources.
Llama Stack, introduced by Meta in July 2024, is an open-source framework designed to streamline the development and deployment of generative AI applications, particularly those using Meta’s Llama models. It provides a cohesive ecosystem for building, deploying, and optimizing AI solutions by integrating capabilities such as inference, safety, memory management, and evaluation. Despite its growing adoption—evidenced by a surge in GitHub stars from 200 to nearly 6,000 in months—the vulnerability was rooted in the default inference implementation, leaving users of alternative implementations (e.g., vLLM, AWS Bedrock) unaffected.
The exploitability of CVE-2024-50050 was demonstrated through a proof-of-concept (PoC) attack. An attacker could identify open ZeroMQ ports on a target host, craft a malicious pickled object containing executable code (e.g., via the reduce method), and send it to the socket using send_pyobj. Upon deserialization by recv_pyobj, the payload would execute arbitrary commands on the host, such as creating files or running system utilities. This attack vector highlights the broader risks of unsafe deserialization in AI pipelines, where untrusted input is processed without validation.
The vulnerability received a CVSS score of 9.3 (Critical) under CVSS v4.0 and 9.8 (Critical) under CVSS v3.1, as assessed by Snyk, reflecting its severe impact. Meta initially assigned a lower score of 6.3 (Medium) pending NVD analysis, though the discrepancy underscores the urgency of patching.
Possible Root Cause
The root cause of CVE-2024-50050 stems from the unsafe use of Python’s pickle module in the Llama Stack inference server. The framework’s default Meta Reference implementation relied on the recv_pyobj method from the pyzmq library to deserialize Python objects received over a ZeroMQ socket. This method automatically invoked pickle.loads, which is inherently insecure when processing untrusted input, as it can execute arbitrary code during deserialization. The vulnerability arose because the ZeroMQ socket was exposed to network input without validation, allowing attackers to send crafted pickled objects that triggered code execution.
The pyzmq library’s recv_pyobj function, introduced approximately eight years prior, was designed to deserialize objects from trusted sources only. Its implementation consists of two lines: passing data to _deserialize with pickle.loads. This design choice amplified the risk, as pickle’s flexibility—including support for custom reduce and __reduce_ex__ methods—enables malicious payloads to execute arbitrary commands during deserialization.
The attack chain exploited this flaw by leveraging the reduce method in a pickled object. When pickle.loads deserialized the object, it executed the specified code, bypassing traditional security controls. For example, an attacker could serialize a class with a reduce method containing a command like touch /tmp/pickle_rce_created_this_file.txt, which would run upon deserialization. This mechanism demonstrates how unsafe deserialization can bypass application-layer defenses, granting attackers system-level access. The vulnerability’s severity was compounded by its presence in a widely adopted framework, increasing the potential attack surface for AI deployments.
Takeaways
Unsafe use of libraries like pickle and pyzmq can introduce remote code execution risks, particularly when network-exposed components process untrusted input. Meta’s response—switching to JSON in the patched version—serves as a model for addressing such vulnerabilities proactively.
The incident also highlights the importance of real-time vulnerability detection in open-source AI tooling. Solutions like Oligo’s Application Detection and Response (ADR) platform demonstrate how runtime profiling can detect anomalous library behavior, such as unexpected code execution during pickle processing. Such tools are essential for organizations deploying AI systems, as they enable immediate incident response before exploits are weaponized.
- Upgrade to Patched Versions: Ensure Llama Stack is updated to version 0.0.41 or higher, which replaces unsafe pickle deserialization with JSON. This mitigates the risk of arbitrary code execution.
- Audit Third-Party Libraries: Review dependencies for unsafe deserialization practices, particularly in libraries like pyzmq, pickle, or other serialization tools. Replace insecure implementations with validated alternatives.
- Implement Runtime Monitoring: Deploy tools capable of detecting anomalous behavior, such as unexpected code execution during deserialization. This includes monitoring for unusual library calls or payloads that trigger exploit patterns.
- Network Segmentation: Restrict access to inference servers and ZeroMQ sockets to trusted sources only.
- Educate Development Teams: Train engineers on secure coding practices for AI frameworks, emphasizing the dangers of unsafe deserialization and the importance of input validation.
As AI adoption accelerates, the industry must prioritize secure-by-design principles, including rigorous testing, dependency audits, and real-time threat detection, to prevent similar exploits in future frameworks.