| --- |
| library_name: onnxruntime |
| tags: |
| - onnx |
| - onnxruntime |
| - security |
| - huntr |
| --- |
| |
| # ONNX Runtime Sparse Initializer Load DoS |
|
|
| Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time memory amplification. |
|
|
| Tiny crafted `SparseTensorProto` initializers can force `onnxruntime` to allocate and materialize a very large dense tensor during normal session creation. |
|
|
| ## Files |
|
|
| - `model/onnx-sparse-initializer-dos.onnx`: crafted 154-byte artifact |
| - `model/small-control.onnx`: 147-byte control artifact |
| - `generator/build_sparse_initializer_load_dos.py`: deterministic internal builder |
| - `reproduce/replay_sparse_initializer_load_dos.py`: isolated replay harness with JSON output |
| - `build-meta.json`: pinned measurements and artifact metadata |
|
|
| ## Differential |
|
|
| - Control: `147` bytes on disk, sparse initializer dense size `4 KiB` |
| - Crafted: `154` bytes on disk, sparse initializer dense size `512 MiB` |
| - Observed on Ubuntu 24.04 x86_64: |
| - `onnxruntime 1.26.0`: crafted load peaks at roughly `1.06 GiB` RSS during session creation |
| - `onnxruntime 1.27.0`: crafted load peaks at roughly `1.06 GiB` RSS during session creation |
| |
| ## Quick Repro |
| |
| ```bash |
| /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \ |
| /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-sparse-initializer-load-dos/reproduce/replay_sparse_initializer_load_dos.py \ |
| --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-sparse-initializer-load-dos/model/onnx-sparse-initializer-dos.onnx \ |
| --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \ |
| --mode default \ |
| --repeats 3 |
| ``` |
| |
| ## Notes |
| |
| - Harmless proof only: the effect is bounded local memory pressure and slower model load. |
| - No victim source modifications are required. |
| - This is not a scanner-bypass claim. |
| |
