CVE-2024-34072

What it actually does

The vulnerability is an unsafe deserialization issue in sagemaker-python-sdk before version 2.218.0, specifically in sagemaker.base_deserializers.NumpyDeserializer when it processes NumPy object arrays that contain pickle data. Pickle is executable by design: crafted serialized objects can invoke Python functions during deserialization. If an application, notebook, training pipeline, inference client, or ML workflow passes attacker-controlled or tampered pickled NumPy object arrays into the vulnerable deserializer, the attacker may execute arbitrary code in the context of the Python process. Impact can include code execution, data theft, model or artifact tampering, credential access from the runtime environment, and process crash or resource exhaustion. The published scoring indicates local attack vector with required user interaction, so exploitation generally depends on a vulnerable workflow consuming malicious data rather than direct unauthenticated network exploitation.

Why it matters to the business

Organizations using affected ML workflows could have model training, inference, or automation environments compromised if they process untrusted NumPy/pickle payloads. A successful attack may expose datasets, model artifacts, credentials, cloud permissions, or proprietary ML code, and may also disrupt workloads through denial of service. The vulnerability is not currently listed in CISA KEV, has no known ransomware association, and has a low EPSS score, which lowers immediate broad exploitation urgency; however, the severity remains high for environments where untrusted or externally supplied ML data is processed. Because the issue has been public for a long period, remaining vulnerable deployments should be treated as avoidable technical debt.

How an attack unfolds

An attacker first identifies a workflow that uses the vulnerable SageMaker Python SDK NumpyDeserializer and can be influenced to deserialize a NumPy object array from an untrusted source, such as a downloaded artifact, shared dataset, prediction response, test fixture, model output, or tampered intermediate file. The attacker creates a NumPy object array containing a malicious pickle payload that triggers code execution when deserialized. They then deliver the payload through the data path the workflow already trusts, often requiring a user, job, notebook, pipeline, or application component to load or process it. When the vulnerable deserializer loads the object array, Python pickle reconstruction executes attacker-selected code inside the runtime process. From there, the attacker may read local files, access environment variables and temporary credentials, alter model artifacts or results, install persistence within the accessible workspace, or deliberately crash the process.

How to fix it

Upgrade sagemaker-python-sdk to version 2.218.0 or later wherever it is used. If tracking source-level fixes in a downstream repository, verify the relevant patched commit is present; the supplied affected-product metadata references gitlab-org/gitlab fixed at commit 85a92396626cc698a65afd57df80298d3439fb87, but the vulnerability description and primary remediation are for sagemaker-python-sdk 2.218.0 or later. For systems that cannot be upgraded immediately, do not pass pickled NumPy object arrays to NumpyDeserializer unless the source is fully trusted and integrity-protected. Remove or block use of pickle-based object arrays for externally supplied data, prefer safer serialization formats, validate MIME types and file provenance, isolate ML processing jobs in least-privilege containers or execution roles, and restrict network and credential access from deserialization workloads.

How to confirm the fix worked

Confirm installed package versions by checking dependency lockfiles, container images, notebooks, build artifacts, and runtime environments for sagemaker-python-sdk versions older than 2.218.0. In Python environments, validate with package tooling such as `pip show sagemaker` or `python -c "import sagemaker; print(sagemaker.__version__)"`. Review code for use of `sagemaker.base_deserializers.NumpyDeserializer` and for workflows accepting `.npy`, `.npz`, pickle, or NumPy object-array inputs from external or user-controlled sources. Confirm that upgraded environments no longer deserialize untrusted pickled object arrays and that CI/CD dependency scans fail builds using vulnerable versions. For mitigation validation, test that untrusted object-array pickle payloads are rejected, quarantined, or never passed to the deserializer.

Typical attack path

1. Identify an ML, notebook, training, inference, or automation workflow using sagemaker.base_deserializers.NumpyDeserializer from sagemaker-python-sdk before 2.218.0.
2. Find a way to supply or tamper with a NumPy object array consumed by that workflow, such as a dataset, serialized model output, artifact, or prediction response.
3. Craft a malicious NumPy object array containing a pickle payload that executes code during deserialization.
4. Induce the vulnerable process or user-driven workflow to deserialize the crafted object array.
5. Execute commands in the context of the Python process running the SDK.
6. Access data, credentials, model artifacts, or cloud resources available to that process, or cause denial of service by crashing or exhausting resources.

How to detect it

To determine whether exploitation may already have occurred, review the systems and workflows that used vulnerable sagemaker-python-sdk versions and consumed NumPy, pickle, or object-array data from untrusted or semi-trusted sources. Relevant log sources include notebook execution history, ML job logs, container stdout/stderr, Python application logs, endpoint invocation logs, artifact download logs, object storage access logs, CI job logs, EDR process telemetry, shell history within persistent workspaces, and cloud audit logs for role or credential use from ML runtimes. Look for Python processes spawning shells or administrative utilities, unexpected outbound network connections from training or inference jobs, access to metadata services or cloud credential endpoints, unusual reads of secrets or environment files, tampered model artifacts, unexpected package installation, and process crashes around deserialization activity. Inspect suspicious `.npy` and `.npz` files for NumPy object arrays containing pickle opcodes or references to command-execution functions such as `os.system`, `posix.system`, `subprocess.Popen`, `eval`, or `exec`. Because there are no public reports of widespread exploitation or named threat actors for this CVE, detection should focus on behavioral evidence and malicious pickle content rather than campaign-specific indicators.

• sagemaker.base_deserializers.NumpyDeserializer
• allow_pickle=True
• dtype=object
• posix\nsystem
• os\nsystem
• subprocess\nPopen
• builtins\neval
• builtins\nexec
• __reduce__
• __reduce_ex__
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• curl http
• wget http
• python -c
• pip install

What your security team should do

• Inventory all ML, notebook, training, inference, CI, and automation environments that install or vendor sagemaker-python-sdk.
• Prioritize upgrade to sagemaker-python-sdk 2.218.0 or later, especially where datasets, artifacts, prediction responses, or model outputs can originate outside a trusted boundary.
• Search code repositories for `NumpyDeserializer`, `allow_pickle`, `pickle`, `.npy`, and `.npz` usage to identify unsafe deserialization paths.
• Block or tightly control ingestion of pickled NumPy object arrays from external contributors, shared storage, user uploads, public datasets, and third-party model artifacts.
• Run vulnerable deserialization workloads with least-privilege cloud roles, no unnecessary secrets, restricted outbound network access, and ephemeral compute where possible.
• Review historical logs and artifacts for suspicious deserialization-related errors, unexpected process launches from Python runtimes, and unusual access to credentials, datasets, or model artifacts.
• Add dependency policy checks to prevent reintroduction of sagemaker-python-sdk versions older than 2.218.0.