/
← Voltar ao feed
high automotive

CVE-2026-12191: Insecure pickle deserialization in comma.ai openpilot modeld enables root RCE on comma 3X

1 fonte(s) · 1 atualização(ões) · publicado 20/07/2026 16:51 · coletado há 1 dia

The Hakai Yokai Research Team disclosed CVE-2026-12191, an insecure deserialization flaw (CWE-502) in openpilot, the open-source Level 2 driver assistance system from comma.ai that supports over 275 vehicle models. The modeld process calls Python pickle.load() / pickle.loads() on model and metadata files with no validation, signature or hash checks. Replacing one of these files gives an attacker code execution as root on the comma 3X device. The researchers warn that this could affect steering, braking and acceleration, and enable surveillance via the device's cameras, GPS and microphone. The vendor reportedly did not respond for a month, so the researchers disclosed via VulnDB and a CVE was published. The article does not report exploitation in the wild.

Technical Details

  • Affected: openpilot 0.11.1, selfdrive/modeld/modeld.py. At least 14 unrestricted pickle calls are reported, including metadata loads (lines 149-163), chunked model graphs via read_file_chunked (lines 190-192) and a dynamic warp_{w}x{h}_tinygrad.pkl path built from VisionIPC width/height (lines 206-210).
  • Exploitation uses the __reduce__ protocol, for example os.system, to run commands at load time. Replacing driving_vision_metadata.pkl produced uid=0(root).
  • The PoC includes a "stealth" payload that uses eval to run side effects while returning a valid-looking metadata dict, so modeld keeps running without a crash.
  • Attack vectors described: physical access via USB-C (payload runs on next boot), SSH on a shared Wi-Fi network with valid credentials, and a supply chain scenario compromising the OTA update channel to hit a whole fleet.
  • Impact: full device control, safety-critical manipulation of vehicle behavior, and espionage via cameras, GPS and microphone.

Remediation

  • Replace pickle with inert formats such as safetensors, ONNX, flatbuffers or schema-based MessagePack.
  • Cryptographically sign model artifacts, chunks and manifests, and verify them before loading.
  • Where pickle remains, use a RestrictedUnpickler with an explicit class allowlist.
  • Verify chunk integrity with SHA-256 hashes before reassembly and deserialization.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 20/07/2026 16:51 · coletado 19/10 18:03 primeiro registro

    CVE-2026-12191: Insecure pickle deserialization in comma.ai openpilot modeld enables root RCE on comma 3X

    ler a análise desta fonte

    The Hakai Yokai Research Team disclosed CVE-2026-12191, an insecure deserialization flaw (CWE-502) in openpilot, the open-source Level 2 driver assistance system from comma.ai that supports over 275 vehicle models. The modeld process calls Python pickle.load() / pickle.loads() on model and metadata files with no validation, signature or hash checks. Replacing one of these files gives an attacker code execution as root on the comma 3X device. The researchers warn that this could affect steering, braking and acceleration, and enable surveillance via the device's cameras, GPS and microphone. The vendor reportedly did not respond for a month, so the researchers disclosed via VulnDB and a CVE was published. The article does not report exploitation in the wild.

    Technical Details

    • Affected: openpilot 0.11.1, selfdrive/modeld/modeld.py. At least 14 unrestricted pickle calls are reported, including metadata loads (lines 149-163), chunked model graphs via read_file_chunked (lines 190-192) and a dynamic warp_{w}x{h}_tinygrad.pkl path built from VisionIPC width/height (lines 206-210).
    • Exploitation uses the __reduce__ protocol, for example os.system, to run commands at load time. Replacing driving_vision_metadata.pkl produced uid=0(root).
    • The PoC includes a "stealth" payload that uses eval to run side effects while returning a valid-looking metadata dict, so modeld keeps running without a crash.
    • Attack vectors described: physical access via USB-C (payload runs on next boot), SSH on a shared Wi-Fi network with valid credentials, and a supply chain scenario compromising the OTA update channel to hit a whole fleet.
    • Impact: full device control, safety-critical manipulation of vehicle behavior, and espionage via cameras, GPS and microphone.

    Remediation

    • Replace pickle with inert formats such as safetensors, ONNX, flatbuffers or schema-based MessagePack.
    • Cryptographically sign model artifacts, chunks and manifests, and verify them before loading.
    • Where pickle remains, use a RestrictedUnpickler with an explicit class allowlist.
    • Verify chunk integrity with SHA-256 hashes before reassembly and deserialization.