Hugging Face's logo

dxoth1nh
/
onnxruntime-local-function-chain-load-segfault

ONNX
onnxruntime
security
huntr
Model card Files
xet
 Community
onnxruntime-local-function-chain-load-segfault / README.md
dxoth1nh's picture
dxoth1nh
Upload minimal PoC artifacts
bb05bdd verified
preview code
|
Raw
History Blame Contribute Delete
2.35 kB
metadata 
library_name: onnxruntime
tags:
  - onnx
  - onnxruntime
  - security
  - huntr

ONNX Runtime Local Function Chain Load Segfault

Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time denial of service.

A crafted ONNX model can define an acyclic chain of model-local functions that exceeds ONNX Runtime's load-path hardening. Current testing shows that onnxruntime.InferenceSession(...) on a roughly 175 KB artifact can recurse until the process exits with SIGSEGV during normal session creation.

Files

  • model/onnx-local-function-depth-dos.onnx: crafted crash artifact
  • model/small-control.onnx: shallow control artifact
  • generator/build_local_function_chain_load_segfault.py: deterministic internal builder
  • reproduce/replay_local_function_chain_load.py: isolated replay harness with JSON output
  • build-meta.json: pinned measurements and artifact metadata

Differential

  • Control: depth=100, accepted by onnx.checker, loads normally in ONNX Runtime
  • Crafted: depth=3000, rejected by onnx.checker depth guard but still accepted by ONNX Runtime's load path and crashes the process
  • Observed on Ubuntu 24.04 x86_64:
    • onnxruntime 1.26.0: crafted session creation exits with SIGSEGV
    • onnxruntime 1.27.0: crafted session creation exits with SIGSEGV

Quick Repro 

/home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/reproduce/replay_local_function_chain_load.py \
  --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/onnx-local-function-depth-dos.onnx \
  --control-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/small-control.onnx \
  --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  --mode default \
  --repeats 1

Notes

  • Harmless proof only: the effect is bounded local process termination and severe load-time slowdown before the crash threshold.
  • No victim source modifications are required.
  • The root cause is distinct from sparse initializer densification: this primitive abuses recursive local-function shape inference and missing depth parity with onnx.checker.