Upload 2 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+malicious.tensors filter=lfs diff=lfs merge=lfs -text

README.md

@@ -0,0 +1,49 @@
+---
+license: mit
+tags:
+  - security
+  - proof-of-concept
+  - tensorizer
+---
+
+# Tensorizer uninitialized-memory-disclosure PoC
+
+This repository contains a proof-of-concept `.tensors` file for a responsibly-disclosed
+vulnerability in [`coreweave/tensorizer`](https://github.com/coreweave/tensorizer) (tested at
+commit `652d3c016c84836bba97153e108821c11428ac40`, version `2.12.1`), reported via huntr's
+Model File Vulnerability program.
+
+## What this file is
+
+`malicious.tensors` is a syntactically valid Tensorizer file whose header/metadata index declares
+one tensor (`poc_tensor`, 200,000 bytes of `float32` data), but whose data section has been
+truncated to only 50,000 real bytes. The declared `data_length` for the tensor is left unchanged.
+
+## What happens when you load it
+
+```python
+from tensorizer import TensorDeserializer
+
+d = TensorDeserializer("malicious.tensors", verify_hash=False, lazy_load=False)
+t = d["poc_tensor"]  # succeeds -- no exception is raised
+```
+
+`TensorDeserializer` allocates the tensor's backing buffer with `torch.empty(...)` (uninitialized
+memory) sized to the *declared* `data_length`, reads however many bytes are actually available
+from the stream via `readinto()`, and never checks that the number of bytes read matches what was
+requested. The 150,000 bytes that were never physically present in the file are left as whatever
+was already sitting in that memory region of the host process — not zeroed, not an error.
+
+Depending on what the host process had recently allocated, this can expose residual heap contents
+(other in-process data) as if it were part of the loaded tensor's legitimate weights, with no
+indication to the caller that anything is wrong.
+
+See the reporter's full write-up submitted via huntr for the complete technical analysis,
+including a reproduction that deliberately "dirties" the process heap with a recognizable byte
+pattern beforehand and shows that pattern reappearing verbatim in the loaded tensor's data.
+
+## Scope note
+
+This PoC is provided solely for the purpose of responsible vulnerability disclosure and
+reproduction by the `tensorizer` maintainers / huntr triage team. It is not intended for any other
+use.

malicious.tensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:08ef0eaf061205d9cd89bdafea0c504de181cdad2bbce8818a3ce6e4ac353b69
+size 312308