Views
No views yet
Coordinated disclosure. Reported privately through huntr (Model File Vulnerability program). Full technical details are shared only with huntr and the maintainer (ARM), and are withheld here until a fix ships. Published for defensive security research only — not for misuse.
.tflite parser
at model-load time — no inference, no authentication. Demonstrated impact: a deterministic
crash / denial-of-service and adjacent-heap corruption, confirmed under AddressSanitizer.
No remote code execution is claimed — the severity is scoped strictly to what was actually proven.ITfLiteParser::CreateNetworkFromBinary[File]) — the standard path any app uses to load a model.| File | Purpose |
|---|---|
evil.tflite | Minimal crafted model that triggers the fault (the proof-of-concept). |
asan_batchtospacend.txt | AddressSanitizer evidence — out-of-bounds write during parsing. |
evil.tflite only faults a vulnerable build of the parser. Do not load untrusted model files in
production; update once ARM ships a fix..armnn, and more). Approach: differential
analysis of recent vendor fixes to surface incomplete-fix variants, rigorous reachability tracing,
and runtime-proven proofs-of-concept with honest, non-inflated severity. Coordinated disclosure,
always. — huntr: Orionix03.