metadata
license: mit
ExecuTorch .pte Parser Vulnerability PoCs
Security research PoCs for integer overflow vulnerabilities in Meta ExecuTorch runtime.
Finding 1: compute_numel() Signed Integer Overflow (Critical)
- File: runtime/core/portable_type/tensor_impl.cpp:41
- Bug: Unchecked signed multiplication of tensor dimensions from .pte FlatBuffer
- Impact: Heap buffer overflow via undersized allocation
- PoC: poc_compute_numel_overflow.py generates malicious_overflow.pte
Finding 2: Segment Offset Addition Overflow (High)
- File: runtime/executor/program.cpp:592,609 and pte_data_map.cpp:58
- Bug: Unchecked uint64 addition bypasses bounds checks
- Impact: Out-of-bounds read from file/memory
- PoC: poc_offset_overflow.py generates malicious .pte files
Usage
pip install flatbuffers python3 poc_compute_numel_overflow.py python3 poc_offset_overflow.py
Responsible Disclosure
Submitted via huntr.com model format vulnerability program.