Views
No views yet
.tfjs-style weights manifest for a
responsibly-disclosed vulnerability in tensorflow/tfjs
(tested at commit 7f5309fef0a47545e34049903dbdae0f97285f7e), reported via huntr's Model File
Vulnerability program.malicious_manifest.json — a weights manifest declaring a single weight, malicious_weight,
of dtype: "string" and shape: [500000000] (500 million).weights.bin — the "backing" weight-data file the manifest points to. It is completely
empty (0 bytes) — there is no real weight data behind the declared shape at all.reproduce.js — loads the manifest using @tensorflow/tfjs's public, officially-documented
tf.io.weightsLoaderFactory API (the same pattern shown in that function's own JSDoc example
for loading weights from disk in Node.js without the native tfjs-node addon) — no internal or
private functions are used.npm install @tensorflow/tfjs
node reproduce.jsFATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory, heap grown past 4 GB) — not merely a temporary freeze. 500000000
was chosen so the demonstration completes in a few minutes; a real attacker could use an even
larger value (e.g. 999999999999, still just a single JSON integer) for a longer/guaranteed crash
against a victim with more available memory. See the reporter's full write-up submitted via huntr
for the complete timing data and crash log.getWeightBytelength() (tfjs-core/src/io/io_utils.ts) computes the
declared string-tensor size (sizeFromShape(shape), unbounded, no validation) and loops that many
times over the weight's binary data — with no check that any real data is actually behind the
declared shape, and no early exit when the (in this case entirely empty) backing buffer is
exhausted.tfjs maintainers / huntr triage team. It is not intended for any other use.
Running it will make your own Node.js process unresponsive for the duration of the demo — this is
expected and is exactly the behavior being reported; do not run it against a shared or
production process.