Skip to content

[fix]rpyc pickle #979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hiworldwzj merged 1 commit into from
Jul 23, 2025
Merged

[fix]rpyc pickle #979

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lightllm/server/embed_cache/manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ def start_cache_manager(port: int, args, pipe_writer):
service = CacheServer(manager)
from rpyc.utils.server import ThreadedServer

t = ThreadedServer(service, port=port)
t = ThreadedServer(service, port=port, protocol_config={"allow_pickle": True})
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Jul 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Enabling allow_pickle is necessary for rpyc.utils.classic.obtain to work, but it introduces a major security vulnerability. An attacker who can connect to this RPyC port can achieve Remote Code Execution (RCE) by sending a malicious pickled object.

The ThreadedServer defaults to listening on all interfaces (0.0.0.0), which could expose this port to a wider network than intended.

To mitigate this risk, consider the following:

  • Bind to localhost: If this cache manager is only used by processes on the same machine, explicitly bind the server to localhost. This would significantly reduce the attack surface.
  • Network Security: If the server must be accessible over the network, ensure that it runs in a trusted network environment and that access to this port is strictly controlled by firewalls.

Given the high risk, binding to localhost is strongly recommended if the architecture permits.

t = ThreadedServer(service, port=port, hostname="127.0.0.1", protocol_config={"allow_pickle": True})

pipe_writer.send("init ok")
t.start()

Expand Down