hacnho/coreml-userdefined-metadata-dos-poc

Core ML userDefined metadata materialization DoS PoC

This repository contains a benign security research PoC for a .mlmodel artifact that drives large metadata materialization during coremltools load_spec(...).

Files:

• control_same_size.mlmodel
• malicious_userdefined_1000000.mlmodel
• reproduce.py

Observed behavior:

• control artifact:
  • parses successfully
  • userDefined metadata count is 0
• malicious artifact:
  • same size as control
  • parses successfully
  • userDefined metadata count is 1,000,000
  • materially increases peak RSS during normal parse

Reproduction:

python3 build_poc.py
python3 reproduce.py