hacnho/nemo-zarr-load-model-weights-amplification-poc

NeMo zarr load_model_weights() amplification PoC

Benign security PoC for a Huntr Model File Vulnerability report.

This bundle demonstrates a file-driven availability issue in a NeMo .nemo archive consumer path:

nemo.export.utils.model_loader.load_model_weights()
 -> load_sharded_metadata_zarr()
 -> zarr.open(...)
 -> arr[:]

The control and malicious .nemo archives are both 10240 bytes. The malicious file changes only the zarr metadata field:

model_weights/foo/.zarray
shape -> [4194304]

On the tested runtime, the valid control finishes quickly after imports settle. The malicious archive converts the same code path into a reproducible timeout.

Files

• load_model_weights_control.nemo valid minimal .nemo archive using zarr-backed weights
• load_model_weights_4m.nemo malicious .nemo archive with forged zarr shape metadata
• nemo_toolkit-2.7.3-py3-none-any.whl exact NeMo wheel used for local verification
• reproduce.py child-process reproducer with per-case timeout and RSS delta reporting
• reproduce-result.json local bundle verification output
• requirements.txt Python dependencies for the reproducer
• MANIFEST.sha256 artifact hashes

Reproduce

python3 -m venv /tmp/nemo-mfvpoc
/tmp/nemo-mfvpoc/bin/python -m pip install --upgrade pip
/tmp/nemo-mfvpoc/bin/python -m pip install -r requirements.txt
/tmp/nemo-mfvpoc/bin/python reproduce.py

Expected result:

• control:
  • status ok
  • shape [4]
  • small rss_delta_kb
  • fast completion
• malicious:
  • status timeout
  • no successful output before timeout

The PoC does not execute user code, does not write outside its own working directory, and is intended only to demonstrate file-driven memory/time amplification in the loader path.