| --- |
| license: mit |
| --- |
| # ExecuTorch .pte Parser Vulnerability PoCs |
|
|
| Security research PoCs for integer overflow vulnerabilities in Meta ExecuTorch runtime. |
|
|
| ## Finding 1: compute_numel() Signed Integer Overflow (Critical) |
| - **File:** runtime/core/portable_type/tensor_impl.cpp:41 |
| - **Bug:** Unchecked signed multiplication of tensor dimensions from .pte FlatBuffer |
| - **Impact:** Heap buffer overflow via undersized allocation |
| - **PoC:** poc_compute_numel_overflow.py generates malicious_overflow.pte |
| |
| ## Finding 2: Segment Offset Addition Overflow (High) |
| - **File:** runtime/executor/program.cpp:592,609 and pte_data_map.cpp:58 |
| - **Bug:** Unchecked uint64 addition bypasses bounds checks |
| - **Impact:** Out-of-bounds read from file/memory |
| - **PoC:** poc_offset_overflow.py generates malicious .pte files |
| |
| ## Usage |
| pip install flatbuffers |
| python3 poc_compute_numel_overflow.py |
| python3 poc_offset_overflow.py |
|
|
| ## Responsible Disclosure |
| Submitted via huntr.com model format vulnerability program. |
|
|
