You can deploy this model and start earning money today!

TheAuroraAi/
pickle-bytearray8-oom-poc

Name: pickle-bytearray8-oom-poc
Availability: InStock

security

poc

cwe-789

Views

No views yet

Pickle BYTEARRAY8 OOM PoC

A 12-byte crafted .pkl file triggers multi-gigabyte memory allocation via pickle.load().

Details

CWE-789: Uncontrolled Memory Allocation in Python Pickle BYTEARRAY8 opcode.

The BYTEARRAY8 opcode (Protocol 5, Python 3.8+) pre-allocates a bytearray of the declared size BEFORE reading any data from the stream. A 12-byte file can declare 4+ GB allocation.

No code execution - no __reduce__, no exec, no imports. Pure data payload.

Files

malicious.pkl (12 bytes) - triggers 500 MB allocation
pickle_oom_poc.py - generator, verifier, and comparison script

Amplification

12-byte file -> 500 MB allocation (this PoC)
12-byte file -> 4 GB allocation (max practical)
Amplification factor: up to 357,913,941x

Reproduction

python

import pickle, resource

# Limit memory for safe testing
soft, hard = resource.getrlimit(resource.RLIMIT_AS)
resource.setrlimit(resource.RLIMIT_AS, (512*1024*1024, hard))

try:
    with open('malicious.pkl', 'rb') as f:
        pickle.load(f)
except MemoryError:
    print("OOM: 12-byte file triggered multi-GB allocation!")
finally:
    resource.setrlimit(resource.RLIMIT_AS, (soft, hard))

Root Cause