Downloads · 30 days
0
circle-onert-micro-omruntimeshape-stack-oob-poc
moon-o/circle-onert-micro-omruntimeshape-stack-oob-poc
circle-onert-micro-omruntimeshape-stack-oob-poc is a machine learning model from moon-o. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
huntr Model File Vulnerability PoC. Loading pocrank7.circle via onert-micro's public OMInterpreter::importModel() (built with -fsanitize=address) triggers a stack-buffer-overflow WRITE at onert-micro/include/core/OMRu…
Access
Public
Updated Jul 13, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 60%
At a glance
- Access
- Public
- Created
- Jul 13, 2026
- Updated
- Jul 13, 2026
- SHA
- 848a8505
Model card
From the Hugging Face model README
Circle (Samsung ONE / onert-micro) stack-buffer-overflow WRITE PoC
huntr Model File Vulnerability PoC. Loading poc_rank7.circle via onert-micro's public OMInterpreter::importModel() (built with -fsanitize=address) triggers a stack-buffer-overflow WRITE at onert-micro/include/core/OMRuntimeShape.h:59 (OMRuntimeShape(const circle::Tensor*)): a file-controlled tensor shape rank drives memcpy(_dims, shape()->data(), 4*rank) into int32_t _dims[6] with NO clamp (sibling constructors clamp). Attacker controls both the length (4*rank) and the content → stack smash. Reachable end-to-end: importModel -> configureKernels/allocateInputs -> OMRuntimeShape. Repo github.com/Samsung/ONE release/onert-micro/2.0.0.
For security research / responsible disclosure only.
- Created
- Jul 13, 2026
- Updated
- Jul 13, 2026