hacnho/joblib-gzip-zlib-trailing-byte-hang-poc

Joblib gzip/zlib trailing-byte hang PoC

This repository contains benign proof-of-concept files for a Joblib model-file parser denial-of-service issue.

Summary

joblib.load() in Joblib 1.5.3 hangs indefinitely when loading a valid gzip- or zlib-compressed Joblib file with a single trailing byte appended.

The control files load normally in under 1 ms. The malicious files differ only by one appended byte and repeatedly block in:

joblib/compressor.py:_fill_buffer
joblib/compressor.py:_read_block
joblib/compressor.py:read
joblib/compressor.py:readinto
pickle.py:load
joblib/numpy_pickle.py:_unpickle
joblib/numpy_pickle.py:load

Files

• control-gzip.joblib: valid gzip-compressed Joblib file.
• malicious-gzip-trailing-byte.joblib: control-gzip.joblib plus one trailing byte.
• control-zlib.joblib: valid zlib-compressed Joblib file.
• malicious-zlib-trailing-byte.joblib: control-zlib.joblib plus one trailing byte.
• reproduce.py: creates and tests equivalent files locally.
• reproduce-result.json: local reproduction output.
• SHA256SUMS.txt: file checksums.

Reproduction

python3 -m pip install 'joblib==1.5.3' numpy
python3 reproduce.py --timeout 12 --stack-delay 4

Expected result:

control_gzip: loads successfully
control_zlib: loads successfully
malicious_gzip_trailing_byte: times out
malicious_zlib_trailing_byte: times out

The PoC does not execute arbitrary code. It only demonstrates a parser hang on attacker-controlled Joblib model files.