jdhart81/executorch-poc

ExecuTorch .pte Parser Vulnerability PoCs

Security research PoCs for integer overflow vulnerabilities in Meta ExecuTorch runtime.

Finding 1: compute_numel() Signed Integer Overflow (Critical)

• File: runtime/core/portable_type/tensor_impl.cpp:41
• Bug: Unchecked signed multiplication of tensor dimensions from .pte FlatBuffer
• Impact: Heap buffer overflow via undersized allocation
• PoC: poc_compute_numel_overflow.py generates malicious_overflow.pte

Finding 2: Segment Offset Addition Overflow (High)

• File: runtime/executor/program.cpp:592,609 and pte_data_map.cpp:58
• Bug: Unchecked uint64 addition bypasses bounds checks
• Impact: Out-of-bounds read from file/memory
• PoC: poc_offset_overflow.py generates malicious .pte files

Usage

pip install flatbuffers python3 poc_compute_numel_overflow.py python3 poc_offset_overflow.py

Responsible Disclosure

Submitted via huntr.com model format vulnerability program.