You can deploy this model and start earning money today!

trevdatastreams/
armnn-mean-invalid-axis-oob-write-poc

Name: armnn-mean-invalid-axis-oob-write-poc
Availability: InStock

Views

No views yet

Arm NN native Mean invalid-axis heap OOB write

Arm NN's native FlatBuffers deserializer accepts a MeanDescriptor containing an axis outside the input tensor rank. During normal graph optimization, MeanLayer::InferOutputShapes() subtracts the number of serialized axes from the output rank, but an out-of-range axis never matches an input dimension. The layer writes all four retained dimensions into a three-element vector.

Tested version

Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820
Public path: IDeserializer::CreateNetworkFromBinary() then armnn::Optimize()
Backend: CpuRef
Instrumentation: AddressSanitizer and UndefinedBehaviorSanitizer

Root cause

ParseMean() copies the attacker-controlled axis vector without validating each value against the input rank:

cpp

descriptor.m_Axis =
    std::vector<unsigned int>(flatBufferAxis->begin(), flatBufferAxis->end());

For a rank-four input and a one-element axis vector, shape inference allocates three output dimensions:

cpp

outputRank = input.GetNumDimensions() -
             armnn::numeric_cast<unsigned int>(m_Param.m_Axis.size());
std::vector<unsigned int> dimSizes(outputRank, 1);

Axis 100 never matches loop indexes zero through three, so all four input dimensions take the unchecked branch:

cpp

dimSizes[outputIndex] =
    armnn::numeric_cast<unsigned int>(input[i]);
++outputIndex;

The fourth write lands immediately after the 12-byte allocation.

Reproduction

./cyber/huntr-mfv/candidates/armnn-flatbuffers-mean-invalid-axis-output-shape-oob-write/reproduce.sh

Three fresh processes per fixture:

Model	Result
`control-axis-2.armnn`	exit 0, 0, 0
`trigger-axis-100.armnn`	ASan heap-buffer-overflow, exit 134, 134, 134

Every trigger reports:

text

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4
0 bytes after 12-byte region

Stable image offsets symbolize to:

text

0x10d7c0 armnn::MeanLayer::InferOutputShapes(...) + 3384
0x10c418 armnn::MeanLayer::ValidateTensorShapesFromInputs() + 740
0x259960 armnn::Graph::InferTensorInfos() + 1160

Differential fixtures

Both files are 552 bytes and differ only at byte offset 249: 0x02 becomes 0x64.

text

c173e99be9ca68671863274bcfed5212b6ba9f1350c9f552026ac0eb63181023  control-axis-2.armnn
b4610241a7f2803cc03d23f85d6ed6ce588c1b61d5c14dc7d69b7921ca1badf0  trigger-axis-100.armnn

Impact

A malformed native .armnn model can corrupt heap memory and terminate an Arm NN consumer during graph optimization, before inference.

Suggested fix

Reject every Mean axis outside [0, input_rank) and reject duplicate axes before output-rank calculation. Defensively bounds-check outputIndex during shape construction.

Prior-art distinction

Automated Hugging Face and local scans returned zero matches, and the only GitHub result was unrelated. Manual source-signature and web searches found no native Mean occurrence. An earlier submitted report affects ReduceLayer.cpp; this occurrence has a different FlatBuffers schema layer, parser function, descriptor type, source file, sink symbol, and fix site.

trevdatastreams/armnn-mean-invalid-axis-oob-write-poc

Arm NN native Mean invalid-axis heap OOB write

Tested version

Root cause

Reproduction

Differential fixtures

Impact

Suggested fix

Prior-art distinction

trevdatastreams/
armnn-mean-invalid-axis-oob-write-poc