README.md

metadata

library_name: onnxruntime
tags:
  - onnx
  - onnxruntime
  - security
  - huntr

ONNX Runtime Sparse Initializer Load DoS

Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time memory amplification.

Tiny crafted SparseTensorProto initializers can force onnxruntime to allocate and materialize a very large dense tensor during normal session creation.

Files

• model/onnx-sparse-initializer-dos.onnx: crafted 154-byte artifact
• model/small-control.onnx: 147-byte control artifact
• generator/build_sparse_initializer_load_dos.py: deterministic internal builder
• reproduce/replay_sparse_initializer_load_dos.py: isolated replay harness with JSON output
• build-meta.json: pinned measurements and artifact metadata

Differential

• Control: 147 bytes on disk, sparse initializer dense size 4 KiB
• Crafted: 154 bytes on disk, sparse initializer dense size 512 MiB
• Observed on Ubuntu 24.04 x86_64:
  • onnxruntime 1.26.0: crafted load peaks at roughly 1.06 GiB RSS during session creation
  • onnxruntime 1.27.0: crafted load peaks at roughly 1.06 GiB RSS during session creation

Quick Repro

/home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-sparse-initializer-load-dos/reproduce/replay_sparse_initializer_load_dos.py \
  --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-sparse-initializer-load-dos/model/onnx-sparse-initializer-dos.onnx \
  --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  --mode default \
  --repeats 3

Notes

• Harmless proof only: the effect is bounded local memory pressure and slower model load.
• No victim source modifications are required.
• This is not a scanner-bypass claim.