Views
No views yet
.keras (ZIP archive with config.json + model.weights.h5)| File | Line | Issue |
|---|---|---|
keras/src/saving/saving_lib.py | _model_from_config() | Raw json.loads(), no sanitization of integer values |
keras/src/saving/serialization_lib.py | deserialize_keras_object() | Immediate instantiation without bounds validation |
keras/src/layers/core/dense.py | __init__() / build() | units > 0 only — no upper bound |
keras/src/layers/core/embedding.py | build() | input_dim > 0, output_dim > 0 only — no upper bound |
keras/src/layers/rnn/lstm.py | build() | units * 4 gate multiplier makes it 4x more dangerous |
1# Present (Dense.__init__):
2if not isinstance(units, int) or units <= 0:
3 raise ValueError(...)
4
5# MISSING:
6if units > MAX_SAFE_UNITS:
7 raise ValueError(f"units={units} exceeds safe limit")| Variant | Config Value | Expected Allocation |
|---|---|---|
| Dense | units=2_000_000_000 | ~8 GB float32 |
| LSTM | units=500_000_000 | ~8 GB (×4 gate multiplier) |
| Embedding | input_dim=100k, output_dim=100k | ~40 GB float32 |
poc_keras_dos.py — generates all 3 variants and triggers loadmalicious_dense.keras — Dense OOM payload (generated by script)malicious_lstm.keras — LSTM OOM payload (generated by script)malicious_emb.keras — Embedding OOM payload (generated by script)1pip install keras h5py
2python poc_keras_dos.py