Views
No views yet
.pt OOB memory corruption bypassing weights_only=TrueSecurity research proof-of-concept for the huntr Model File Vulnerability program (target: PyTorch Package.pt). The model file is non-destructive: loading it with the documented-safe loader succeeds with no error, and a routinematmulthen crashes the process (SIGSEGV) by reading out of bounds. It writes nothing and runs no shell commands.
malicious_sparse.pt is a sparse CSR tensor of declared shape (1, 4) whose
crow_indices claim 1,048,576 nonzeros while its col_indices/values arrays
hold a single element. PyTorch's weights_only unpickler allow-lists
torch._utils._rebuild_sparse_tensor, which builds it with check_invariants=False,
and the deferred validator _validate_loaded_sparse_tensors skips validation by
default (check_sparse_tensor_invariants is off). So:1import torch
2t = torch.load("malicious_sparse.pt", weights_only=True) # SAFE loader: NO error
3torch.mm(t, torch.ones(t.size(-1), 2)) # OOB read -> SIGSEGVtorch.load(weights_only=True) — the mode documented as safe for untrusted files.No issues found! (the file has no unsafe pickle
opcodes; the danger is in tensor data).1pip install torch==2.12.0
2python3 poc.py # build + load(weights_only=True) + matmul -> SIGSEGV (exit 139)
3# to use THIS repo's bundled file instead of rebuilding:
4MAL_PT=./malicious_sparse.pt python3 poc.py trigger
5modelscan -p malicious_sparse.pt # -> "No issues found!"malicious_sparse.pt — the malicious (non-destructive) PyTorch model file.poc.py — builds the file (build) and demonstrates the load+matmul crash (trigger).check_sparse_tensor_invariants flag, or bounds-check crow_indices[-1]
against the col_indices/values lengths in _rebuild_sparse_tensor.main @ 61fcec9.