README.md

ExecuTorch .pte — integer overflow → out-of-bounds read & heap write (PoC)

Security PoC for a huntr "Model File Format Vulnerability" report against pytorch/executorch. Gated repository (manual review). Reproduces on pip install executorch==1.3.1 and on ExecuTorch source HEAD 4af91c3d (2026-07-04).

What this is

A malicious .pte model file declares a tensor whose element count × element size overflows size_t. ExecuTorch computes the tensor byte size with an unchecked multiply (compute_numel / TensorImpl::nbytes()), so the overflowed value (e.g. 0) passes the bounds checks in get_constant_buffer_data and HierarchicalAllocator::get_offset_address, while the tensor still reports ~2⁶² elements over a few-KB buffer. Kernels then read or write far out of bounds.

Full write-up: REPORT.md.

Files

• build_c.py / run_c.py — build + run the OOB read PoC (sum over an overflowed constant).
• build_full.py / introspect.py / patch_sizes.py / run_full.py — build the OOB write PoC (full into an overflowed memory-planned tensor).
• valid_c.pte, mal_c.pte — benign vs malicious (read); valid_full.pte, mal_full3.pte (write).
• ctrl_c_bignoof.pte — control: large-but-NON-overflowing sizes; the runtime correctly rejects it (proves the bounds check works and only the overflow bypasses it).
• asan-evidence/READ_sum.txt, asan-evidence/WRITE_full.txt — AddressSanitizer traces.

Reproduce (release runtime, no build)

pip install executorch==1.3.1
python run_c.py valid_c.pte     # -> tensor([2953665.])  (exit 0)
python run_c.py mal_c.pte       # -> SIGSEGV (OOB read)
python run_full.py valid_full.pte   # -> runs, tensor(17019.)
python run_full.py mal_full3.pte    # -> SIGSEGV (OOB write)

Reproduce with AddressSanitizer (precise READ/WRITE traces)

Build executor_runner with -fsanitize=address (portable kernels), then:

executor_runner --model_path mal_c.pte      # heap-buffer-overflow READ  @ op_sum.cpp:117
executor_runner --model_path mal_full3.pte  # heap-buffer-overflow WRITE @ op_full.cpp:40

See asan-evidence/ for captured output.