You can deploy this model and start earning money today!

Yash1106/
onnx-inliner-mutual-recursion-dos

Name: onnx-inliner-mutual-recursion-dos
Availability: InStock

onnx

Views

No views yet

ONNX Inliner Mutual Recursion DoS (SIGSEGV)

Vulnerability Summary

CWE-674: Uncontrolled Recursion

The ONNX library's function inliner (onnx.inliner.inline_local_functions()) crashes with SIGSEGV (stack overflow) when processing models containing mutually recursive functions.

Affected Component

Package: onnx (NOT onnxruntime)
Function: onnx.inliner.inline_local_functions()
Vulnerable Code: onnx/inliner/inliner.cc:606
Tested Version: onnx 1.18.0

Root Cause

In inliner.cc, the append_node() function (line 581-606) recursively processes function calls without:

Cycle detection for mutual recursion
Depth limit for recursion

When Function A calls Function B, and Function B calls Function A, the inliner infinitely recurses until stack overflow.

Reproduction

bash

pip install onnx

# Download PoC
wget https://huggingface.co/Yash1106/onnx-inliner-mutual-recursion-dos/resolve/main/mutual_recursion_poc.onnx
wget https://huggingface.co/Yash1106/onnx-inliner-mutual-recursion-dos/resolve/main/poc_mutual_recursion.py

# Run PoC
python3 poc_mutual_recursion.py
# Expected: Exit code 139 (SIGSEGV)

Or minimal reproduction:

python

import onnx
from onnx import inliner

model = onnx.load("mutual_recursion_poc.onnx")
inliner.inline_local_functions(model)  # CRASHES with SIGSEGV

Impact

Denial of Service: Any application using inline_local_functions() on untrusted models can be crashed
Exit Code: 139 (SIGSEGV - Segmentation Fault)

Technical Details

The malicious model contains:

FunctionA which calls FunctionB
FunctionB which calls FunctionA
Main graph calls FunctionA

When inliner processes this:

Encounters FunctionA call → inlines FunctionA
FunctionA contains FunctionB call → inlines FunctionB
FunctionB contains FunctionA call → inlines FunctionA
... infinite recursion → stack overflow → SIGSEGV

Note

The ONNX checker (onnx.checker.check_model()) does NOT detect mutual recursion - it passes validation.