hacnho/coreml-input-fanout-dos-poc

Core ML input fanout amplification PoC

This repository is a benign security research PoC for the Huntr Model File Formats program.

Files:

• control_same_size.mlmodel: same-size control model with one large metadata string.
• malicious_inputs_1600000.mlmodel: Core ML protobuf model with 1,600,000 description.input entries.
• reproduce.py: compares memory/time behavior for coremltools.models.utils.load_spec() and coremltools.models.MLModel(..., skip_model_load=True).

Observed marker:

• control: inputs == 0
• malicious: inputs == 1600000

Reproduction:

python -m venv /tmp/coreml-input-fanout-venv
/tmp/coreml-input-fanout-venv/bin/python -m pip install --upgrade pip
/tmp/coreml-input-fanout-venv/bin/python -m pip install -r requirements.txt
/tmp/coreml-input-fanout-venv/bin/python reproduce.py \
  --control control_same_size.mlmodel \
  --malicious malicious_inputs_1600000.mlmodel

Expected result:

• load_spec() and MLModel(skip_model_load=True) both accept the malicious file as a structurally valid Core ML spec
• the malicious file raises parse time and peak RSS far above the same-size control

This repo does not contain an exploit payload. It demonstrates parser and deserialization resource amplification from a Core ML .mlmodel file.