hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc

Cambricon CNRT partial-handle query segfault PoC

This repository contains a Cambricon .mef sample copied from Cambricon's public Docker image plus a full-size mutated variant.

Observed behavior in CNRT 4.9.1:

• control sample:
  • cnrtLoadModelFromMem() succeeds
  • cnrtQueryModelParallelism() succeeds
• malicious full-size sample with bytes 8..11 = 00 00 00 00:
  • cnrtGetModelSize() returns handled error 632011
  • cnrtGetModelLevelFromFile() still succeeds with level 6
  • cnrtLoadModelFromMem() returns handled error 632007 but leaves a non-zero model_ptr
  • cnrtQueryModelParallelism() on that returned handle exits 139

Files:

• control_mlp_mlu270.mef: control sample from the public image
• malicious_headerword_zero_offset8.mef: crafted full-size header mutation
• probe_partial_handle.py: minimal metadata, load, and post-load query probe
• reproduce.py: control-vs-malicious host-side reproducer

Public repo:

• Repo: https://huggingface.co/hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc
• Control file: https://huggingface.co/hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc/resolve/main/control_mlp_mlu270.mef
• Malicious file: https://huggingface.co/hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc/resolve/main/malicious_headerword_zero_offset8.mef
• Reproducer: https://huggingface.co/hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc/resolve/main/reproduce.py
• Probe: https://huggingface.co/hacnho/cambricon-cnrt-loadmodelfrommem-partial-handle-query-segfault-poc/resolve/main/probe_partial_handle.py
• Repo state at verification time: private=false, commit bb7d0a5beca5d5379dfa4b5b9829505ab53f9726

Reproduction:

python3 build_poc.py
python3 reproduce.py