PyTorch mobile flatbuffer TensorMetadata OOB PoC

This repository contains a minimal proof of concept for a lite-interpreter / mobile flatbuffer vulnerability in PyTorch's torch.jit.mobile._load_for_lite_interpreter(...) path.

What this PoC shows

A valid .ptl flatbuffer can be mutated so TensorMetadata.sizes[0] exceeds a 4-byte storage.
On official torch-2.13.0+cpu, clone_return leaks heap bytes during forward().
On official torch-2.13.0+cpu, fill_return crashes with SIGSEGV during forward().

What this PoC does not show

It does not claim a generic torch.jit.load or pickle RCE issue.
It does not prove code execution.
It is specific to the lite-interpreter / mobile flatbuffer path.

Reproduction

PYTHONPATH=/tmp/pytorch-flatbuffer-test python3 poc_mobile_flatbuffer_tensor_oob.py --scenario clone_return --new-size 8192 --ops summary forward_only
PYTHONPATH=/tmp/pytorch-flatbuffer-test python3 poc_mobile_flatbuffer_tensor_oob.py --scenario fill_return --new-size 8192 --ops summary

Tested version

torch-2.13.0+cpu

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support