Downloads · 30 days
0
coreml-dos-poc
ericblackgachara/coreml-dos-poc
coreml-dos-poc is a machine learning model from ericblackgachara. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Status: PoC CONFIRMED ✅ — Ready for huntr submission
Access
Public
Updated May 9, 2026
Repo size
119 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pdf119 KB · 92%
At a glance
- Access
- Public
- Created
- May 9, 2026
- Updated
- May 9, 2026
- SHA
- d319b266
Model card
From the Hugging Face model README
CoreML — DoS via Malformed INT4 Tensor in .mlpackage
Status: PoC CONFIRMED ✅ — Ready for huntr submission
| Field | Value |
|---|---|
| Target | coremltools (huntr.com — apple/coremltools) |
| Format | CoreML mlpackage (.mlpackage) |
| Vuln | CWE-20 — Improper Input Validation → unhandled ValueError → DoS |
| CVSS | 7.5 High |
| Trigger | ct.optimize.coreml.linear_quantize_weights(mlmodel, config) → ValueError |
Quick Repro
python3 poc/make_poc.py # creates /tmp/evil.mlpackage
python3 poc/trigger.py # ValueError → crash
Files
poc/make_poc.py— PoC builderpoc/trigger.py— crash triggerreport.md— huntr submission reportevidence/poc-run.html— self-contained HTML evidence
Key Source Location
- Primary:
coremltools/converters/mil/frontend/milproto/load.py:165element_num = np.prod(shape)— no validation of shape vs actual byte count.reshape(shape)raises uncaughtValueErrorwhen shape product ≠ actual elements
Attack Summary
Craft a .mlpackage with an INT4 const op where:
shape = [2^40, 1](1,099,511,627,776 declared elements)bytes = b'\xab\xcd'(only 2 bytes = 4 INT4 values)
When linear_quantize_weights() processes the model, it calls _restore_np_from_bytes_value(),
which unpacks 4 elements from the 2-byte buffer but then calls .reshape([2^40, 1]) → ValueError.
Exception propagates uncaught through the entire call chain.
- Created
- May 9, 2026
- Updated
- May 9, 2026