Kanisia/caffe-batchnorm-incomplete-blobs-uaf-poc

Caffe BatchNorm incomplete-statistics heap use-after-free

Summary

The Caffe BatchNorm layer accepts a serialized layer containing any nonzero number of blobs. During CPU inference with use_global_stats: true, it unconditionally accesses three statistics blobs: mean (blobs_[0]), variance (blobs_[1]), and scale factor (blobs_[2]). A model that supplies only one attacker-controlled statistics blob therefore causes an out-of-bounds std::vector<shared_ptr<Blob>> access. AddressSanitizer reports the resulting access as a heap-use-after-free during net.Forward().

This repository contains a valid control pair with all three statistics blobs and a malicious pair with only one. Both are ordinary Caffe model artifacts:

• control_complete_batchnorm.prototxt and control_complete_batchnorm.caffemodel
• malicious_partial_batchnorm.prototxt and malicious_partial_batchnorm.caffemodel

Reproduction

Prerequisite: Docker Desktop with Linux containers running. From this directory, run:

python build_and_verify.py

The verifier builds BVLC Caffe at the pinned upstream commit with AddressSanitizer and CPU-only support. The Dockerfile includes a one-line Protobuf API compatibility change needed to compile this unmaintained revision against Debian 12; it does not modify BatchNormLayer. It first runs the complete control, which exits successfully. It then loads the malicious .prototxt and .caffemodel and invokes Net::Forward() on CPU. The malicious run must exit nonzero and its sanitizer output must contain both ERROR: AddressSanitizer: heap-use-after-free and BatchNormLayer.

The script writes its compact result to verify_report.json.

Root cause

BatchNormLayer::LayerSetUp() treats every nonempty this->blobs_ vector as initialized. It does not require the three blobs that Forward_cpu() assumes exist. In test mode, Forward_cpu() dereferences indexes 2, 0, and 1 without checking either vector length or blob shapes. A truncated or attacker-crafted serialized BatchNorm layer therefore performs an out-of-bounds vector access that AddressSanitizer classifies as a heap-use-after-free during normal CPU inference.

Impact

An application that loads an untrusted Caffe model can be made to perform a native invalid heap access merely by loading the model and running a normal forward pass. The proof of concept demonstrates a sanitizer-detected heap use-after-free; no GPU, custom Python layer, or nonstandard runtime option is required. This is memory corruption in model-file processing rather than a malformed-file error handled safely by Caffe.

Suggested remediation

Require exactly three non-null BatchNorm blobs before accepting serialized parameters, and validate their element counts against channels_ (mean/variance) and one (scale factor). Reject malformed model files before any blobs_ dereference in Forward_cpu() or Forward_gpu().