CVE-2022-34668: NVFLARE Pickle Deserialization and the Federated Learning Attack Surface
| CVE | Score | Component | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2022-34668 | 9.8 Critical | NVFLARE — all platforms | v2.1.4 | August 2022 |
Discovered by Oliver Sellwood and Elias Hohl. A working exploit is publicly available on Exploit-DB. EPSS score: 27.09%.
For executives
NVIDIA Federated Learning Application Runtime Environment (NVFLARE) enables multiple institutions to collaboratively train AI models without sharing raw data. CVE-2022-34668 is a remote code execution vulnerability in NVFLARE's serialisation layer. An unprivileged network attacker who is a participant in a federated learning federation can send a malicious payload to the NVFLARE server and execute arbitrary code on it. CVSS 9.8. A working exploit has been publicly available since 2022.
The exploit
Python's pickle module executes instructions embedded in serialised byte streams to reconstruct objects — those instructions can include arbitrary Python code. NVFLARE used pickle to serialise messages passed between federation participants and the server, without verifying that those messages came from trusted sources before deserialising them.
A connected client sends a specially crafted pickle payload. The server deserialises it as part of normal federation operation. The payload executes with the server's process privileges. Through the server's authority over connected clients, code execution on all participating institutions simultaneously is potentially achievable.
The broader NVFLARE deserialization cluster
Earlier versions before 2.1.2 were vulnerable to unsafe YAML loading. The PKI implementation module also used pickle to transport CA credentials. The fix for CVE-2022-34668 replaced pickle with MessagePack across NVFLARE's serialisation layer.
Patch
Upgrade NVFLARE to version 2.1.4 or later.