Add README.md

42844e3 verified 18 days ago

870 Bytes

license: mit
tags:
  - security
  - poc
  - executorch

Harmless PoC: ExecuTorch MethodMeta non_const_buffer_device vector length OOB

MethodMeta::memory_planned_buffer_device loops ExecutionPlan.non_const_buffer_device using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and calling memory_planned_buffer_device(0) triggers ASan heap-buffer-overflow READ at method_meta.cpp:391.

Distinct from packaged MethodMeta non_const_buffer_sizes / memory_planned_buffer_size, I/O index, Tensor.sizes, Program execution_plan/backend_delegate_data, Method::init vectors.

Files

poc_method_meta_buffer_device_asan.cpp, asan.log
method_load_stub.cpp (link stub for unused Method::load)
NOTES.md

./poc_method_meta_buffer_device_asan