| # ExecuTorch `.pte` — integer overflow → out-of-bounds read & heap write (PoC) |
|
|
| > Security PoC for a huntr "Model File Format Vulnerability" report against `pytorch/executorch`. |
| > **Gated repository (manual review).** Reproduces on `pip install executorch==1.3.1` and on ExecuTorch |
| > source HEAD `4af91c3d` (2026-07-04). |
|
|
| ## What this is |
| A malicious `.pte` model file declares a tensor whose element count × element size overflows `size_t`. |
| ExecuTorch computes the tensor byte size with an **unchecked** multiply (`compute_numel` / |
| `TensorImpl::nbytes()`), so the overflowed value (e.g. 0) passes the bounds checks in |
| `get_constant_buffer_data` and `HierarchicalAllocator::get_offset_address`, while the tensor still |
| reports ~2⁶² elements over a few-KB buffer. Kernels then read or write far out of bounds. |
|
|
| Full write-up: `REPORT.md`. |
|
|
| ## Files |
| - `build_c.py` / `run_c.py` — build + run the **OOB read** PoC (`sum` over an overflowed constant). |
| - `build_full.py` / `introspect.py` / `patch_sizes.py` / `run_full.py` — build the **OOB write** PoC |
| (`full` into an overflowed memory-planned tensor). |
| - `valid_c.pte`, `mal_c.pte` — benign vs malicious (read); `valid_full.pte`, `mal_full3.pte` (write). |
| - `ctrl_c_bignoof.pte` — control: large-but-NON-overflowing sizes; the runtime correctly **rejects** it |
| (proves the bounds check works and only the overflow bypasses it). |
| - `asan-evidence/READ_sum.txt`, `asan-evidence/WRITE_full.txt` — AddressSanitizer traces. |
|
|
| ## Reproduce (release runtime, no build) |
| ```bash |
| pip install executorch==1.3.1 |
| python run_c.py valid_c.pte # -> tensor([2953665.]) (exit 0) |
| python run_c.py mal_c.pte # -> SIGSEGV (OOB read) |
| python run_full.py valid_full.pte # -> runs, tensor(17019.) |
| python run_full.py mal_full3.pte # -> SIGSEGV (OOB write) |
| ``` |
|
|
| ## Reproduce with AddressSanitizer (precise READ/WRITE traces) |
| Build `executor_runner` with `-fsanitize=address` (portable kernels), then: |
| ```bash |
| executor_runner --model_path mal_c.pte # heap-buffer-overflow READ @ op_sum.cpp:117 |
| executor_runner --model_path mal_full3.pte # heap-buffer-overflow WRITE @ op_full.cpp:40 |
| ``` |
| See `asan-evidence/` for captured output. |
|
|
