ONNX Shape Inference Stack Overflow (DoS) - PoC
⚠️ SECURITY RESEARCH - DO NOT LOAD THIS MODEL OUTSIDE A SANDBOX
Vulnerability Summary
Title: Unbounded Recursion in shape_inference::TraverseGraphsToAddExistingSymbols leads to Stack Overflow (DoS)
Affected Library: ONNX (onnx/shape_inference/implementation.cc)
Severity: High (Denial of Service)
Description
The function TraverseGraphsToAddExistingSymbols recursively traverses subgraphs without any depth limit. An attacker can create a malicious ONNX model with deeply nested If nodes and call onnx.shape_inference.infer_shapes(). This causes the C++ stack to overflow, resulting in a Segmentation Fault and crashing the inference server.
Steps to Reproduce
- Load
crash_model.onnx using onnx.load().
- Call
onnx.shape_inference.infer_shapes(model).
- Program crashes with "Fatal Python error: Cannot recover from stack overflow".
Impact
Denial of Service (DoS). An attacker can crash any service that performs shape inference on untrusted ONNX models.
Files
crash_model.onnx - Malicious ONNX model with nested If nodes
