.riva (EFF archive) PickleContentCallback default → RCE PoC
malicious.riva is a gzip-compressed tar archive (the EFF/.riva format used
by nvidia-eff, a hard dependency of nemo2riva). Its manifest.yaml
declares one artifact with content_callback: PickleContentCallback
(the library's own documented default deserializer) wrapping an object
whose __reduce__ returns (os.system, ("touch /tmp/PWNED", )).
Inspecting it with NVIDIA's own official eff-inspect CLI (installed
automatically alongside nemo2riva):
eff-inspect malicious.riva content -a model_graph.riva
executes the os.system call — arbitrary code execution triggered purely by
"inspecting" an untrusted .riva file's content with the standard tooling
shipped for this format.
manifest.yaml inside the archive is 100% attacker-controlled and directly
selects the deserialization callback with no allowlist — eff.core.ArtifactRegistry.create()'s
own docstring documents PickleContentCallback as the DEFAULT choice when
no callback is specified, so this isn't an obscure/unsupported code path.
picklescan cannot parse the gzip/tar EFF container as a pickle file at all
and reports a completely clean scan (0 infected, 0 dangerous globals) on this
file — a working RCE payload sails through undetected.
nemo2riva's own source code (artifacts.py) is not directly responsible —
it always hardcodes a safe BinaryContentCallback for its own export path.
The vulnerable logic lives in nvidia-eff (the closed-source, Pyarmor-obfuscated
package from pypi.nvidia.com that actually implements the .riva/EFF
archive format and that nemo2riva requires — requirements.txt: nvidia-eff>=0.6.4).
Reported to huntr.com as a Model File Vulnerability (MFV) submission ("Riva – NVIDIA" format).