| license: mit | |
| tags: | |
| - security | |
| - poc | |
| - do-not-load | |
| # ⚠️ Tensorizer CWE-835 PoC — DO NOT LOAD IN PRODUCTION | |
| Proof-of-concept files for an infinite-loop DoS in `coreweave/tensorizer` ≤ 2.12.1. | |
| Submitted to the vendor via huntr.com Model File Format program. | |
| **Loading `loop.tensors` with `TensorDeserializer` will hang the process at 100% CPU.** | |
| ## Files | |
| | file | effect | | |
| |---|---| | |
| | `loop.tensors` | Infinite read/seek loop in `_copy_thread` (`serialization.py:3076-3093`) | | |
| | `evil.tensors` | Object-dtype `PyObject*` type-confusion primitive (`_NumpyTensor.py:169`); currently gated by `torch.from_numpy` | | |
| | `poc_infinite_loop.py` | Generates `loop.tensors` and demonstrates the hang | | |
| | `poc_object_dtype.py` | Generates `evil.tensors` and demonstrates the primitive | | |
| ## Repro | |
| ```bash | |
| pip install tensorizer==2.12.1 torch --index-url https://download.pytorch.org/whl/cpu | |
| python poc_infinite_loop.py | |
| # → [PASS] PoC SUCCESS: TensorDeserializer hung >8s | |
| ``` | |
| ## Root cause | |
| Signed `<q data_length` + independent metadata/header name fields → `file_.seek(negative, SEEK_CUR)` rewinds to the same header inside `while tensors_read < len(tensor_items)` where the counter only increments on name match. | |