You can deploy this model and start earning money today!

hacnho/
nemo-zarr-load-model-weights-amplification-poc

model-format-vulnerability

apache-2.0

Views

No views yet

NeMo zarr `load_model_weights()` amplification PoC

Benign security PoC for a Huntr Model File Vulnerability report.

This bundle demonstrates a file-driven availability issue in a NeMo .nemo archive consumer path:

text

nemo.export.utils.model_loader.load_model_weights()
 -> load_sharded_metadata_zarr()
 -> zarr.open(...)
 -> arr[:]

The control and malicious .nemo archives are both 10240 bytes. The malicious file changes only the zarr metadata field:

text

model_weights/foo/.zarray
shape -> [4194304]

On the tested runtime, the valid control finishes quickly after imports settle. The malicious archive converts the same code path into a reproducible timeout.

Files

load_model_weights_control.nemo valid minimal .nemo archive using zarr-backed weights
load_model_weights_4m.nemo malicious .nemo archive with forged zarr shape metadata
nemo_toolkit-2.7.3-py3-none-any.whl exact NeMo wheel used for local verification
reproduce.py child-process reproducer with per-case timeout and RSS delta reporting
reproduce-result.json local bundle verification output
requirements.txt Python dependencies for the reproducer
MANIFEST.sha256 artifact hashes

Reproduce

bash

python3 -m venv /tmp/nemo-mfvpoc
/tmp/nemo-mfvpoc/bin/python -m pip install --upgrade pip
/tmp/nemo-mfvpoc/bin/python -m pip install -r requirements.txt
/tmp/nemo-mfvpoc/bin/python reproduce.py

Expected result:

control:
- status ok
- shape [4]
- small rss_delta_kb
- fast completion
malicious:
- status timeout
- no successful output before timeout

The PoC does not execute user code, does not write outside its own working directory, and is intended only to demonstrate file-driven memory/time amplification in the loader path.

hacnho/nemo-zarr-load-model-weights-amplification-poc

NeMo zarr load_model_weights() amplification PoC

Files

Reproduce

hacnho/
nemo-zarr-load-model-weights-amplification-poc

NeMo zarr `load_model_weights()` amplification PoC