| # ExecuTorch `.pte` — default Minimal verification bypass PoC model files |
|
|
| Malicious ExecuTorch (`.pte`) model files that cause an out-of-bounds read and a controllable |
| adjacent-heap information disclosure when loaded via the default C++ path (`Module::load` / |
| `executor_runner` / `Program::load(loader)`), which uses `Verification::Minimal`. Tested on |
| pytorch/executorch HEAD `ab45eb6` (`runtime/executor/program.cpp`). |
|
|
| | File | Result | Sink | |
| |---|---|---| |
| | `et_oob_read.pte` | out-of-bounds READ during load (CWE-125) | `Program::load`, `program.cpp:251` | |
| | `et_leak.pte` | controllable adjacent-heap info disclosure (CWE-200) | `get_method_name`, `program.cpp:366` | |
| | `et_valid.pte` | loads cleanly (negative control) | — | |
|
|
| ## Root cause |
|
|
| The default load mode is `Verification::Minimal`, in which `VerifyProgramBuffer` is not called — only a |
| root-offset bounds check runs. All subsequent FlatBuffers vtable/vector/string offsets from the `.pte` |
| are dereferenced unvalidated: |
|
|
| - `constant_segment->offsets()` (`program.cpp:251`) → OOB read during `Program::load`. |
| - `get_method_name()` returns `name->c_str()` (`program.cpp:366`), an unvalidated FlatBuffers string |
| offset; `c_str()` ignores the length prefix and reads to a NUL, so an attacker-chosen offset leaks |
| arbitrary-location/length adjacent process memory through a public, loggable API. |
|
|
| ## Reproduce |
|
|
| Official tool `executor_runner` built with AddressSanitizer (uses `Module::load` = |
| `Verification::Minimal` by default): |
|
|
| ``` |
| ./executor_runner --model_path et_oob_read.pte # heap-buffer-overflow READ at program.cpp:251 |
| ./executor_runner --model_path et_valid.pte # loads cleanly |
| ``` |
|
|
| `leak_demo.py` shows attacker control over the disclosed memory location for `et_leak.pte`. |
|
|
| Verifier-bypass proof: the same files loaded with `Verification::InternalConsistency` are cleanly |
| rejected ("Verification failed", InvalidProgram, no crash) — the verifier would have caught them; the |
| default Minimal path skips it. |
|
|
| ## Suggested fix |
|
|
| Make `InternalConsistency` the default for untrusted input, or bounds-check the string/vector offsets |
| in Minimal mode, or document Minimal as trusted-input-only and have `Module`/`executor_runner` validate. |
|
|
| Crash/leak-only proof of concept. |
|
|
