You can deploy this model and start earning money today!

trevdatastreams/
circle-mlir-operator-output-oob-poc

Name: circle-mlir-operator-output-oob-poc
Availability: InStock

Views

No views yet

Samsung/ONE Circle-MLIR operator-output index OOB read

This gated repository contains a minimal, benign proof of concept for a heap-buffer-overflow read in the Samsung/ONE Circle-MLIR importer.

Scope

Target: Samsung/ONE
Commit tested: 342395fc0d6bf29e2ea939ef0a7eced18d677f81
Component: Circle-MLIR importer
Format: Circle (CIR0)
Weakness: CWE-125, out-of-bounds read
Demonstrated impact: deterministic native-process crash during import

No code execution, information disclosure, network access, persistence, or credential access is claimed or attempted.

Root cause

Operator.outputs contains model-controlled tensor indexes. The importer uses those indexes against containers sized from SubGraph.tensors without first checking that each index is non-negative and less than tensors.size().

The sanitizer-visible dereference occurs in OpLoc():

cpp

for (auto tensor_index : op.outputs)
  locations.push_back(TensorLoc(*tensors[tensor_index], builder, base));

The same unvalidated output indexes are also used earlier to index is_op_output:

cpp

llvm::SmallVector<bool, 16> is_op_output(subgraph.tensors.size(), false);
for (auto &op : subgraph.operators)
  for (auto output : op->outputs)
    is_op_output[output] = true;

FlatBuffers verification validates the serialized object layout, not these cross-table index relationships.

Pinned source:

Proof of concept

poc.circle is derived from the repository's official 672-byte tools/model_explorer_circle/tests/test.circle fixture. It changes one byte: the first operator's first output index is changed from 2 to 5, exactly one past the model's five-element tensor table.

File size: 672 bytes
File identifier: CIR0
Changed zero-based byte offset: 292
SHA-256: 6f90d118c04722677e5425abd9eb8fe095a5dc618f53624d88bfd57214ecaa78

mutate-circle-output-index.mjs deterministically recreates the artifact from the upstream fixture without third-party packages.

Observed result

With an AddressSanitizer build:

text

Control model, import-only: exit 0
PoC model, import-only: exit 1

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8
#3 OpLoc .../CircleImport.cpp:126
#4 ConvertSubgraph .../CircleImport.cpp:902
#5 FlatBufferToMlir .../CircleImport.cpp:1059
#6 circleImportExport .../circleimpexp.cpp:127

0x604000002478 is located 0 bytes to the right of 40-byte region
[0x604000002450,0x604000002478)

The 40-byte region is the five-element std::vector<std::unique_ptr<circle::TensorT>> allocated while unpacking the model.

Build details and caveat

The proof was built from the affected commit with GCC AddressSanitizer inside Samsung's official nnfw/circle-mlir-build:jammy image, digest sha256:412acf7b0c91694db5997bfd9597c16e4ed98ff0e3237dff06243a8e9769269d.

That image predates the tested source and its prebuilt Abseil library is incompatible with current headers. Two test-only compatibility changes were used:

Avoid flat_hash_map::contains() when the signature map is empty.
Exit immediately after successful FlatBufferToMlir() when running the import-only test.

Neither change touches OpLoc(), the operator-output loop, model unpacking, or the candidate data flow. The clean model completes the same import-only path; the one-byte-mutated model crashes before the test-only exit.

Suggested remediation

Before processing operators, validate every non-optional tensor index in subgraph inputs and outputs and in operator inputs, outputs, and intermediates. Reject any index that is negative where not explicitly permitted or greater than or equal to subgraph.tensors.size(). Retain checks at dereference sites as defense in depth, and add a regression test with an output index equal to the tensor count.

Prior-art note

CVE-2020-15211 is adjacent but distinct. It concerns TensorFlow Lite runtime handling of the optional -1 tensor index. This finding concerns the Circle-MLIR importer, a positive index equal to the tensor count, and the OpLoc() dereference of the unpacked tensor vector.

trevdatastreams/circle-mlir-operator-output-oob-poc