| --- |
| license: mit |
| tags: |
| - security |
| - proof-of-concept |
| - tensorizer |
| --- |
| |
| # Tensorizer uninitialized-memory-disclosure PoC |
|
|
| This repository contains a proof-of-concept `.tensors` file for a responsibly-disclosed |
| vulnerability in [`coreweave/tensorizer`](https://github.com/coreweave/tensorizer) (tested at |
| commit `652d3c016c84836bba97153e108821c11428ac40`, version `2.12.1`), reported via huntr's |
| Model File Vulnerability program. |
|
|
| ## What this file is |
|
|
| `malicious.tensors` is a syntactically valid Tensorizer file whose header/metadata index declares |
| one tensor (`poc_tensor`, 200,000 bytes of `float32` data), but whose data section has been |
| truncated to only 50,000 real bytes. The declared `data_length` for the tensor is left unchanged. |
|
|
| ## What happens when you load it |
|
|
| ```python |
| from tensorizer import TensorDeserializer |
| |
| d = TensorDeserializer("malicious.tensors", verify_hash=False, lazy_load=False) |
| t = d["poc_tensor"] # succeeds -- no exception is raised |
| ``` |
|
|
| `TensorDeserializer` allocates the tensor's backing buffer with `torch.empty(...)` (uninitialized |
| memory) sized to the *declared* `data_length`, reads however many bytes are actually available |
| from the stream via `readinto()`, and never checks that the number of bytes read matches what was |
| requested. The 150,000 bytes that were never physically present in the file are left as whatever |
| was already sitting in that memory region of the host process — not zeroed, not an error. |
|
|
| Depending on what the host process had recently allocated, this can expose residual heap contents |
| (other in-process data) as if it were part of the loaded tensor's legitimate weights, with no |
| indication to the caller that anything is wrong. |
|
|
| See the reporter's full write-up submitted via huntr for the complete technical analysis, |
| including a reproduction that deliberately "dirties" the process heap with a recognizable byte |
| pattern beforehand and shows that pattern reappearing verbatim in the loaded tensor's data. |
|
|
| ## Scope note |
|
|
| This PoC is provided solely for the purpose of responsible vulnerability disclosure and |
| reproduction by the `tensorizer` maintainers / huntr triage team. It is not intended for any other |
| use. |
|
|
