ericblackgachara/coreml-dos-poc

CoreML — DoS via Malformed INT4 Tensor in .mlpackage

Status: PoC CONFIRMED ✅ — Ready for huntr submission

Field	Value
Target	coremltools (huntr.com — apple/coremltools)
Format	CoreML mlpackage (.mlpackage)
Vuln	CWE-20 — Improper Input Validation → unhandled ValueError → DoS
CVSS	7.5 High
Trigger	ct.optimize.coreml.linear_quantize_weights(mlmodel, config) → ValueError

Quick Repro

python3 poc/make_poc.py    # creates /tmp/evil.mlpackage
python3 poc/trigger.py     # ValueError → crash

Files

• poc/make_poc.py — PoC builder
• poc/trigger.py — crash trigger
• report.md — huntr submission report
• evidence/poc-run.html — self-contained HTML evidence

Key Source Location

• Primary: coremltools/converters/mil/frontend/milproto/load.py:165
  • element_num = np.prod(shape) — no validation of shape vs actual byte count
  • .reshape(shape) raises uncaught ValueError when shape product ≠ actual elements

Attack Summary

Craft a .mlpackage with an INT4 const op where:

• shape = [2^40, 1] (1,099,511,627,776 declared elements)
• bytes = b'\xab\xcd' (only 2 bytes = 4 INT4 values)

When linear_quantize_weights() processes the model, it calls _restore_np_from_bytes_value(), which unpacks 4 elements from the 2-byte buffer but then calls .reshape([2^40, 1]) → ValueError. Exception propagates uncaught through the entire call chain.