ArmNN TFLite parser — memory-safety PoC (coordinated disclosure)
Coordinated disclosure. Reported privately through huntr (Model File Vulnerability program). Full technical details are shared only with huntr and the maintainer (ARM), and are withheld here until a fix ships. Published for defensive security research only — not for misuse.
Summary (high level)
A crafted TensorFlow-Lite model triggers an out-of-bounds heap write in ArmNN's .tflite parser
at model-load time — no inference, no authentication. Demonstrated impact: a deterministic
crash / denial-of-service and adjacent-heap corruption, confirmed under AddressSanitizer.
No remote code execution is claimed — the severity is scoped strictly to what was actually proven.
How it was found (methodology)
- Differential analysis of ARM's recent parser-hardening commits → identified an incomplete-fix variant: a type guard added to one operator but missing on its direct sibling.
- Reachability-verified at the public, documented load API
(
ITfLiteParser::CreateNetworkFromBinary[File]) — the standard path any app uses to load a model. - Runtime-proven, not speculative: a single crafted file that passes the format's structural verifier reproduces the fault deterministically under AddressSanitizer (trace included below).
Contents
| File | Purpose |
|---|---|
evil.tflite |
Minimal crafted model that triggers the fault (the proof-of-concept). |
asan_batchtospacend.txt |
AddressSanitizer evidence — out-of-bounds write during parsing. |
Responsible use
evil.tflite only faults a vulnerable build of the parser. Do not load untrusted model files in
production; update once ARM ships a fix.
About Orionix. Independent security research focused on memory-safety in machine-learning
model-file parsers (TFLite, GGUF, Circle, ExecuTorch, .armnn, and more). Approach: differential
analysis of recent vendor fixes to surface incomplete-fix variants, rigorous reachability tracing,
and runtime-proven proofs-of-concept with honest, non-inflated severity. Coordinated disclosure,
always. — huntr: Orionix03.
- Downloads last month
- 1