Upload findings.json with huggingface_hub
Browse files- findings.json +65 -0
findings.json
ADDED
|
@@ -0,0 +1,65 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
{
|
| 2 |
+
"title": "ModelScan Missing Scanner for TFLite (.tflite) Format Allows Undetected Malicious Models",
|
| 3 |
+
"severity": "HIGH",
|
| 4 |
+
"target": "ModelScan 0.8.7 (ProtectAI)",
|
| 5 |
+
"cwe": "CWE-693: Protection Mechanism Failure",
|
| 6 |
+
"summary": "ModelScan has no scanner for .tflite model files. TFLite models can embed dangerous TF ops via the Flex delegate mechanism (FlexWriteFile, FlexReadFile, EagerPyFunc) that achieve arbitrary file I/O and code execution when loaded on any runtime with Flex delegate support (standard on Android). The same WriteFile op that ModelScan flags as HIGH severity in SavedModel .pb format goes completely undetected in .tflite format.",
|
| 7 |
+
"impact": {
|
| 8 |
+
"file_write": "FlexWriteFile op writes arbitrary files to filesystem",
|
| 9 |
+
"file_read": "FlexReadFile op reads arbitrary files from filesystem",
|
| 10 |
+
"code_exec": "EagerPyFunc op executes arbitrary Python code",
|
| 11 |
+
"platforms": [
|
| 12 |
+
"Android apps with tensorflow-lite-select-tf-ops",
|
| 13 |
+
"TFLite deployments compiled with SELECT_TF_OPS",
|
| 14 |
+
"Any runtime with FlexDelegate enabled"
|
| 15 |
+
]
|
| 16 |
+
},
|
| 17 |
+
"proof": {
|
| 18 |
+
"modelscan_comparison": {
|
| 19 |
+
"saved_model_pb_WriteFile": "DETECTED - IssueSeverity.HIGH",
|
| 20 |
+
"tflite_FlexWriteFile": "NOT DETECTED - 0 issues, file skipped"
|
| 21 |
+
},
|
| 22 |
+
"malicious_models_created": {
|
| 23 |
+
"flex_write.tflite": "872 bytes, contains FlexWriteFile",
|
| 24 |
+
"flex_read.tflite": "740 bytes, contains FlexReadFile",
|
| 25 |
+
"pyfunc.tflite": "740 bytes, contains EagerPyFunc",
|
| 26 |
+
"debug_print.tflite": "700 bytes, contains FlexPrintV2"
|
| 27 |
+
},
|
| 28 |
+
"modelscan_supported_extensions": [
|
| 29 |
+
".bin",
|
| 30 |
+
".ckpt",
|
| 31 |
+
".dat",
|
| 32 |
+
".data",
|
| 33 |
+
".dill",
|
| 34 |
+
".h5",
|
| 35 |
+
".joblib",
|
| 36 |
+
".keras",
|
| 37 |
+
".npy",
|
| 38 |
+
".pb",
|
| 39 |
+
".pickle",
|
| 40 |
+
".pkl",
|
| 41 |
+
".pt",
|
| 42 |
+
".pth"
|
| 43 |
+
],
|
| 44 |
+
"tflite_supported": false
|
| 45 |
+
},
|
| 46 |
+
"additional_findings": {
|
| 47 |
+
"flatbuffer_crashes": {
|
| 48 |
+
"description": "Single bit-flips in .tflite FlatBuffer cause SIGSEGV in TFLite interpreter",
|
| 49 |
+
"crash_offsets": [
|
| 50 |
+
199,
|
| 51 |
+
459,
|
| 52 |
+
1214,
|
| 53 |
+
21,
|
| 54 |
+
326
|
| 55 |
+
],
|
| 56 |
+
"severity": "MEDIUM (DoS, potential memory corruption)"
|
| 57 |
+
},
|
| 58 |
+
"integer_overflow": {
|
| 59 |
+
"description": "Crafted tensor dimensions cause integer overflow in allocation",
|
| 60 |
+
"dim_product_overflow": "SIGKILL (OOM)",
|
| 61 |
+
"huge_alloc": "SIGABRT"
|
| 62 |
+
}
|
| 63 |
+
},
|
| 64 |
+
"recommendation": "Add a TFLite scanner to ModelScan that parses the FlatBuffer format and checks for Flex ops (FlexWriteFile, FlexReadFile, FlexPrintV2, etc.) and custom ops (EagerPyFunc)"
|
| 65 |
+
}
|