Kanisia/onnx-range-inference-dos-modelscan-bypass

ONNX Range Inference DoS ModelScan Bypass

Target

ONNX model format.

Summary

onnx_range_inference_dos.onnx is a 136-byte ONNX model with no inputs. It passes ONNX validation, passes ONNX shape inference, and loads successfully in ONNX Runtime.

When inference is executed, the graph uses Range with start=0.0, limit=4294967296.0, and delta=1.0 to create a float32 output tensor with shape [4294967296], requiring at least 17,179,869,184 bytes of output memory. The local verification run times out during inference.

ModelScan does not scan ONNX files and reports SCAN_NOT_SUPPORTED with no issues.

Files

• onnx_range_inference_dos.onnx: PoC model file to upload to Hugging Face.
• build_and_verify.py: Builds the model and verifies load, validation, shape inference, runtime behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-onnx-range-inference-dos\build_and_verify.py

Expected result:

• model size is 136 bytes.
• onnx.load_model succeeds.
• onnx.checker.check_model succeeds.
• onnx.shape_inference.infer_shapes_path succeeds.
• onnxruntime.InferenceSession load succeeds.
• inference times out because Range attempts to materialize a huge output tensor.
• ModelScan reports no issues and skips the ONNX file as SCAN_NOT_SUPPORTED.

Impact

An attacker can publish a tiny ONNX model that passes validation and loads normally, but causes resource exhaustion during inference without requiring any input. Automated systems that rely on ModelScan receive no warning because the ONNX file is not inspected.