Use JSON instead of pickle for P2P ZMQ requests (#4804)
fix(disagg): use JSON instead of pickle for P2P ZMQ requests (#4804) (#4812)
Use JSON instead of pickle for P2P ZMQ requests (#4804)f05b4a-fix-use-json-instead-of-pickle-for-cve-2026-76850fixuse json instead pickle p2p zmq
Committed by Anai-Guo
commit message
fix(disagg): use JSON instead of pickle for P2P ZMQ requests (#4804) (#4812)
* fix(disagg): use JSON instead of pickle for P2P ZMQ requests (#4804)
recv_pyobj()/send_pyobj() call pickle.loads() on peer-supplied bytes in
the disaggregated-serving P2P connector, and the reachable path is an
unauthenticated POST to /distserve/p2p_connect that makes the engine's
PULL socket connect to a caller-chosen address. A crafted pickle payload
on that address is arbitrary code execution on the engine node.
Switch the connector's only wire message (DistServeCacheFreeRequest) to
send_json()/recv_json() and validate it with model_validate before use,
so decoding is json.loads (no code execution) and the schema check runs
before the payload is acted on. Malformed/off-schema messages are logged
and skipped instead of tearing down the detached receive loop.
* fix comment
---------
Co-authored-by: caikun-pjlab <[email protected]>Editor assessment
This commit patches CVE-2025-66455. Exemplary. The subject names the replacement and the transport, and the body explains the full chain: recv_pyobj/send_pyobj call pickle.loads on peer-supplied bytes, the reachable unauthenticated POST makes the engine connect to a caller-chosen address, and a crafted pickle is arbitrary code execution. It then describes the JSON switch and model_validate before use, plus the malformed-message handling. Complete and teaching. Style-wise the header is precise and the body is separated and complete; no structural improvement is needed.