You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

Circle SQUEEZE rank-nine stack out-of-bounds write

This directory contains a CPU-only proof of concept for a stack out-of-bounds write in Samsung ONE's Circle interpreter. malicious_squeeze_rank9.circle contains a SQUEEZE input tensor with nine dimensions, all with extent one. The parser accepts the model. During Interpreter::interpret(), luci_interpreter::kernels::Squeeze::configure() writes the ninth boolean into its fixed bool should_squeeze[8] stack array.

control_squeeze_rank8.circle is identical except that its input tensor has eight dimensions and it completes inference normally.

Affected release

The vulnerable code is present in the public Samsung/ONE 1.30.1 tag in compiler/luci-interpreter/src/kernels/Squeeze.cpp. Runtime verification was performed on commit de7f4736dc4c4f5e47f72a4022a9aa9ac6d1ad1a, an immediately later public source snapshot whose affected Squeeze.cpp implementation is unchanged from 1.30.1.

Reproduction

Clone the affected release and copy this directory into the checkout:

git clone --branch 1.30.1 --depth 1 https://github.com/Samsung/ONE.git one
cp -a circle-squeeze-rank9 one/scratch-squeeze-rank9
cd one
docker build -t circle-squeeze-asan -f scratch-squeeze-rank9/Dockerfile .
docker run --rm -v "$PWD:/src" -w /src circle-squeeze-asan \
  bash scratch-squeeze-rank9/run_asan.sh

Expected control output:

INTERPRETER_CONSTRUCTED
INFERENCE_COMPLETED

Expected malicious output contains AddressSanitizer: stack-buffer-overflow, a WRITE of size 1, and a stack trace beginning at luci_interpreter::kernels::Squeeze::configure().

Files

malicious_squeeze_rank9.circle: proof-of-concept model.
control_squeeze_rank8.circle: non-crashing control model.
build_squeeze_probe.py: deterministically rebuilds both Circle files from the ONE schema.
circle_load_harness.cpp: imports a Circle model and calls CPU inference.
run_asan.sh: builds the interpreter in Release mode with AddressSanitizer and runs control and malicious inputs.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support