| --- |
| library_name: onnxruntime |
| tags: |
| - onnx |
| - onnxruntime |
| - security |
| - huntr |
| --- |
| |
| # ONNX Runtime Local Function Chain Load Segfault |
|
|
| Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time denial of service. |
|
|
| A crafted ONNX model can define an acyclic chain of model-local functions that exceeds ONNX Runtime's load-path hardening. Current testing shows that `onnxruntime.InferenceSession(...)` on a roughly `175 KB` artifact can recurse until the process exits with `SIGSEGV` during normal session creation. |
|
|
| ## Files |
|
|
| - `model/onnx-local-function-depth-dos.onnx`: crafted crash artifact |
| - `model/small-control.onnx`: shallow control artifact |
| - `generator/build_local_function_chain_load_segfault.py`: deterministic internal builder |
| - `reproduce/replay_local_function_chain_load.py`: isolated replay harness with JSON output |
| - `build-meta.json`: pinned measurements and artifact metadata |
|
|
| ## Differential |
|
|
| - Control: `depth=100`, accepted by `onnx.checker`, loads normally in ONNX Runtime |
| - Crafted: `depth=3000`, rejected by `onnx.checker` depth guard but still accepted by ONNX Runtime's load path and crashes the process |
| - Observed on Ubuntu 24.04 x86_64: |
| - `onnxruntime 1.26.0`: crafted session creation exits with `SIGSEGV` |
| - `onnxruntime 1.27.0`: crafted session creation exits with `SIGSEGV` |
| |
| ## Quick Repro |
| |
| ```bash |
| /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \ |
| /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/reproduce/replay_local_function_chain_load.py \ |
| --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/onnx-local-function-depth-dos.onnx \ |
| --control-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/small-control.onnx \ |
| --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \ |
| --mode default \ |
| --repeats 1 |
| ``` |
| |
| ## Notes |
| |
| - Harmless proof only: the effect is bounded local process termination and severe load-time slowdown before the crash threshold. |
| - No victim source modifications are required. |
| - The root cause is distinct from sparse initializer densification: this primitive abuses recursive local-function shape inference and missing depth parity with `onnx.checker`. |
| |
