CVE-2024-27322

What it actually does

Deserialization of untrusted data in R versions 1.4.0 through 4.3.x allows arbitrary code execution when a malicious RDS file or R package is loaded.

Why it matters to the business

Compromise of data science and statistical computing environments can lead to data theft, ransomware deployment, or supply-chain attacks against organizations relying on R for analytics or package distribution.

How an attack unfolds

An attacker creates a malicious RDS file or R package containing serialized objects that trigger code execution on load; the file or package is delivered to a victim who interacts with it in an affected R installation, resulting in immediate arbitrary code execution on the end-user system.

How to fix it

Upgrade R to version 4.4.0 or later. For the listed packages apply the following exact fixes: buildkitd (Chainguard) 0.13.1-r2, buildkitd (Wolfi) 0.13.1-r2, buildctl (Chainguard) 0.13.1-r2, buildctl (Wolfi) 0.13.1-r2.

How to confirm the fix worked

Verify R version is 4.4.0 or newer; confirm the listed packages report the fixed versions above; test loading of known-good RDS files and packages to ensure normal operation.

Typical attack path

1. Craft malicious RDS file or R package embedding arbitrary code
2. Deliver the file via email, repository, or supply chain
3. Victim loads the RDS or installs/loads the package in vulnerable R
4. Deserialization executes attacker-controlled code

How to detect it

Review logs for unexpected process creation or network activity immediately after RDS file loads; inspect package installation history and file hashes of recently added .rds or .rda files; correlate with user activity involving R.

What your security team should do

• Immediately upgrade all R installations to 4.4.0+ and apply the listed package fixes
• Scan internal package repositories and shared RDS files for signs of tampering
• Restrict loading of untrusted RDS files and R packages until upgrades are complete
• Monitor EPSS score and any new exploit maturity signals given the 898 days since publication