Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization
### Summary
An unsafe deserialization vulnerability in Scapy <v2.7.0 allows attackers to execute arbitrary code **when a malicious session file is locally loaded via the `-s` option**. This requires convincing a user to manually load a malicious session file.
---
### Details
Scapy’s interactive shell supports session loading using gzip-compressed pickle files:
```bash
./run_scapy -s <session_file.pkl.gz>
```
Internally, this triggers:
```python
# main.py
SESSION = pickle.load(gzip.open(session_name, "rb"))
```
Since no validation or restriction is performed on the deserialized object, **any code embedded via `__reduce__()` will be exe
scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.