You can deploy this model and start earning money today!

trevdatastreams/
armnn-batch-space-vector-mismatch-oob-poc

Name: armnn-batch-space-vector-mismatch-oob-poc
Availability: InStock

Views

No views yet

Arm NN native Batch/Space descriptor vector mismatch OOB reads

Arm NN's native FlatBuffers deserializer accepts BatchToSpaceNd and SpaceToBatchNd descriptors whose blockShape length exceeds the number of crops or padList pairs. Normal graph optimization then iterates over every block-shape entry and indexes the shorter paired vector without a bounds check.

The included models use two block-shape entries and only one crop or padding pair. Both trigger deterministic AddressSanitizer heap-buffer-overflow reads during public .armnn deserialization plus normal armnn::Optimize().

Tested version

Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820
Backend selected for optimization: CpuRef
Instrumentation: AddressSanitizer and UndefinedBehaviorSanitizer

Root cause

ParseBatchToSpaceNd() validates only that the flat crops vector has an even length. ParseSpaceToBatchNd() does the same for padList. Neither parser requires:

text

blockShape.size() == crops.size() / 2
blockShape.size() == padList.size() / 2

The vectors are copied independently into their descriptors. During graph shape inference:

cpp

for (unsigned int i = 0; i < m_Param.m_BlockShape.size(); ++i)
{
    unsigned int cropSize =
        m_Param.m_Crops[i].first + m_Param.m_Crops[i].second;
}

and:

cpp

for (unsigned int i = 0; i < m_Param.m_BlockShape.size(); ++i)
{
    outputShape[spatialDimension] =
        (inputShape[spatialDimension] +
         m_Param.m_PadList[i].first +
         m_Param.m_PadList[i].second) /
        m_Param.m_BlockShape[i];
}

At i == 1, the single-pair m_Crops or m_PadList vector is read immediately beyond its eight-byte allocation.

Reproduction

From the workspace root:

./cyber/huntr-mfv/candidates/armnn-flatbuffers-batch-space-vector-mismatch-oob-read/reproduce.sh

Verified in three fresh processes per model:

Model	Result
`control-batch-to-space.armnn`	exit 0, 0, 0
`control-space-to-batch.armnn`	exit 0, 0, 0
`trigger-batch-to-space.armnn`	ASan heap-buffer-overflow, exit 134, 134, 134
`trigger-space-to-batch.armnn`	ASan heap-buffer-overflow, exit 134, 134, 134

Symbolized trigger sinks:

text

armnn::BatchToSpaceNdLayer::InferOutputShapes(...) + 2832
armnn::BatchToSpaceNdLayer::ValidateTensorShapesFromInputs()
armnn::Graph::InferTensorInfos()
armnn::Optimize(...)

text

armnn::SpaceToBatchNdLayer::InferOutputShapes(...) + 2788
armnn::SpaceToBatchNdLayer::ValidateTensorShapesFromInputs()
armnn::Graph::InferTensorInfos()
armnn::Optimize(...)

Fixture hashes

text

d0a6dbde7dbcba4e59ae14d49151584da1fa41d4f0348e8065ffd26f9cc915d4  control-batch-to-space.armnn
8c7bfd08cd8a76c41b2b8f931f12e5f1453ebd328c148cfed4c61b4056685bd3  control-space-to-batch.armnn
d8d55eef2c8cbcfc04669c45c8f32d5f9f0021735da890c17aa49d169957777d  trigger-batch-to-space.armnn
f0168e3cc41a396b764360e1f01bb092115084fd2f7782c4c0bc5c0fb7d2dee1  trigger-space-to-batch.armnn

Impact

An attacker-controlled .armnn model can trigger a native heap out-of-bounds read while the network is optimized, before inference.

Suggested fix

Reject each descriptor unless its block-shape length exactly matches the number of crop or padding pairs. Validate the relationship in the deserializer and defensively in each layer's shape-inference method.

Prior art

Automated Hugging Face, GitHub, and local scans returned zero matches. Manual ARM repository, Huntr, Hugging Face, and web searches found adjacent Arm NN dimension-vector and padding bugs, but no report for this cross-vector blockShape versus crops / padList mismatch. The public ParsePad odd-padList occurrence is a different parser and input invariant.

trevdatastreams/armnn-batch-space-vector-mismatch-oob-poc

Arm NN native Batch/Space descriptor vector mismatch OOB reads

Tested version

Root cause

Reproduction

Fixture hashes

Impact

Suggested fix

Prior art

trevdatastreams/
armnn-batch-space-vector-mismatch-oob-poc