hacnho/joblib-loky-spawnv-passfds-ace-poc

Joblib loky spawnv_passfds ACE PoC

This repository contains a bounded security research PoC for a scanner-clean .joblib artifact that invokes joblib.externals.loky.backend.resource_tracker.spawnv_passfds during joblib.load().

Files

• control_plain_dict.joblib - benign control artifact.
• malicious_loky_spawnv_passfds.joblib - spawns the current Python interpreter and writes a marker file in the reproduction temp directory.
• reproduce.py - loads each artifact and waits on the returned child PID.
• requirements.txt - tested dependencies.

Exact public file URLs:

• https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/control_plain_dict.joblib
• https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/malicious_loky_spawnv_passfds.joblib
• https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/reproduce.py
• https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/requirements.txt

Tested Environment

• joblib==1.5.3
• picklescan==1.0.4
• modelscan==0.8.8

Reproduction

python3 -m venv /tmp/joblib-spawnv-poc
/tmp/joblib-spawnv-poc/bin/pip install -U pip
/tmp/joblib-spawnv-poc/bin/pip install -r requirements.txt
/tmp/joblib-spawnv-poc/bin/python reproduce.py *.joblib

Expected marker for the malicious artifact:

mfv_loky_spawnv_passfds_marker.txt

Scanner results:

• picklescan==1.0.4: infected_files = 0, issues_count = 0.
• modelscan==0.8.8: No issues found!.