1badrun/tensorizer-header-len-dos-poc

This PoC model artifact demonstrates a denial-of-service issue in CoreWeave Tensorizer 2.12.1.

The crafted .tensors file contains a valid Tensorizer container prefix and metadata index, but the per-tensor header length field is set to an attacker-controlled oversized value. During deserialization, _TensorHeaderDeserializer.from_io() reads this 8-byte length and immediately executes bytearray(header_len) before enforcing any maximum size, EOF check, or consistency validation against the metadata index.

Affected path:

• tensorizer/serialization.py
• _TensorHeaderDeserializer.from_io()
• TensorDeserializer(..., lazy_load=False) default eager load path

Impact:

A small malicious model artifact can force the loading process to allocate excessive memory and terminate with MemoryError or crash under normal service memory limits. In systems that automatically load Tensorizer model artifacts from Hugging Face, object storage, or user-provided repositories, this can cause application-level denial of service.

Local reproduction:

1. Download tensorizer_2_12_1_header_len_dos.tensors from this Hugging Face repository.
2. Run Tensorizer 2.12.1 locally.
3. Load the file with:

from tensorizer import TensorDeserializer

TensorDeserializer(
    "tensorizer_2_12_1_header_len_dos.tensors",
    device="cpu",
    lazy_load=False,
    num_readers=1,
)

4. Observe that deserialization fails during header parsing due to unbounded allocation from the forged header length.

Security controls:

Testing was performed only in a local environment with memory limits. No CoreWeave production infrastructure or third-party systems were accessed.

Suggested fix:

Validate header_len before allocation. Enforce a reasonable maximum header size, reject truncated reads, and verify that header/data offsets and lengths match the metadata index before constructing buffers.

Estimated severity:

High availability impact in automated model-loading services.

CVSS 3.1: 7.5 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H