ericblackgachara/TFlite-oob-poc

TFLite — OOB Read via Crafted String Tensor

Status: PoC CONFIRMED ✅ — Ready for huntr submission

Field	Value
Target	tensorflow-lite (huntr.com — tensorflow/tensorflow)
Format	.tflite (FlatBuffers)
Vuln	CWE-125 Out-of-Bounds Read
CVSS	8.2 High
Trigger	tf.lite.Interpreter("poc.tflite") → invoke() → SIGSEGV
Exit code	139 (repeatable)

Quick Repro

python3 poc/make_poc.py    # creates poc.tflite
python3 poc/trigger.py     # crashes with SIGSEGV
echo $?                    # 139

Files

• poc/make_poc.py — PoC builder
• poc/trigger.py — crash trigger
• poc/poc.tflite — 428-byte malicious model
• report.md — huntr submission
• evidence/poc-run.html — self-contained HTML evidence page

Key Source Locations

• Root cause: tensorflow/compiler/mlir/lite/utils/string_utils.h (GetString, no bounds check)
• Sink: tensorflow/lite/kernels/fill.cc:112 (FillString → AddString from OOB ptr)
• Load skip: tensorflow/lite/core/subgraph.cc:1944 (string tensors skip BytesRequired check)