| # F003 v2 — Joblib BinaryZlibFile unused_data OOM / Loader DoS |
| |
| ## Status |
| |
| This is a stronger evidence pack for existing F003. It is not a new finding ID. |
| |
| ## Confirmed Claim |
| |
| A crafted compressed .joblib file can cause joblib.load() to enter an unbounded decompression path in BinaryZlibFile._fill_buffer() by repeatedly feeding zlib unused_data back into a finished decompressor. This causes exponential unused_data growth and process-level denial of service. |
| |
| ## PoC File |
| |
| Path: |
| poc/f003_unused_data_oom.joblib |
|
|
| SHA256: |
| 9673f843f3d71ceb65db8764ea74ee58186b10083ccf66322a1b0e9d9033db0a |
|
|
| Size: |
| 66 bytes |
|
|
| ## Confirmed Evidence |
|
|
| - evidence/01_unused_data_growth.txt |
| Shows deterministic unused_data doubling from 52 bytes to 436,207,616 bytes. |
|
|
| - evidence/02_direct_joblib_load_oom_or_timeout.txt |
| Shows direct joblib.load() of the crafted file inside a Docker memory limit. |
|
|
| Confirmed direct-load result: |
| direct_load_rc=137 |
|
|
| ## Safe Impact Statement |
|
|
| In applications or model-serving services that call joblib.load() on attacker-supplied .joblib files without subprocess isolation, memory limits, or timeout controls, each malicious file can terminate a loading worker. Multiple submissions can cause low-bandwidth worker or pod exhaustion. |
|
|
| ## Non-Claims |
|
|
| - No RCE claimed. |
| - No data theft claimed. |
| - No host/container escape claimed. |
| - No persistent outage after worker restart claimed. |
| - No claim that every deployment is remotely exploitable. |
| - No claim that every historical Joblib version is affected unless separately verified. |
|
|
