Kanisia/tflite-embedding-sparse-coordinate-oob-poc

TFLite EMBEDDING_LOOKUP_SPARSE unchecked sparse-coordinate PoC

This package demonstrates a CPU-only out-of-bounds access in the TFLite reference EMBEDDING_LOOKUP_SPARSE kernel. The model controls a coordinate in the indices tensor that is used to calculate current_output_offset. The per-element aggregation loop checks that offset, but the final FinalizeAggregation() call dereferences &GetTensorData<float>(output)[current_output_offset] without checking that the coordinate is inside the declared dense_shape.

control_valid_sparse_index.tflite uses coordinate 0 and completes. malicious_sparse_index_far_oob.tflite declares dense_shape=[1,1] but uses coordinate 100000000. It reaches a read-modify-write at an out-of-range output pointer during Invoke().

Files

• build_probe.py creates the control and malicious .tflite files.
• invoke_ref.py reproduces the behavior with the public Python tf.lite.Interpreter API and the CPU reference resolver.
• runtime_harness.cc and CMakeLists.txt are a minimal C++ reference-kernel harness used for AddressSanitizer verification.
• asan_report.txt contains the captured sanitizer trace.

Quick reproduction

Install the dependencies from requirements.txt, regenerate the model files, then run either model with the Python reference resolver:

python build_probe.py
python invoke_ref.py control_valid_sparse_index.tflite
python invoke_ref.py malicious_sparse_index_far_oob.tflite

On TensorFlow 2.21.0 for Windows, the control exits normally and the malicious model terminates with access violation 0xC0000005. The sanitizer verification was run on a current CPU-only source build and is recorded in asan_report.txt.