PoC: rebuildTensor Missing Storage Bounds Check → Heap OOB Read/Write

Vulnerability: torch/csrc/jit/serialization/unpickler.cpp:979-982 — rebuildTensor() uses unsafeGetTensorImpl() to set storage_offset and sizes/strides from attacker-controlled pickle data without validating they fit within the storage allocation.

Files

poc_jit_rebuild_oob.py — Full PoC (creates crafted models, demonstrates OOB read + SIGSEGV crash)
oob_read_model.pt — Crafted model with offset=1000 (heap data leak)
oob_write_model.pt — Crafted model with offset=268435456 (SIGSEGV crash)

Quick Start

pip install torch
python poc_jit_rebuild_oob.py

Expected Output

Heap OOB Read: leaks heap data from byte 4000 of 32-byte storage
SIGSEGV crash on both read and write at large offset

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support