hacnho/tfrecord-feature-byteslist-value-materialization-dos-poc

TFRecords Feature bytes_list.value materialization DoS PoC

This repository contains a benign security research PoC for a .tfrecords artifact that drives large protobuf materialization during tf.train.Feature.FromString(...).

Files:

• control_same_size.tfrecords
• malicious_feature_byteslist_value_5000000.tfrecords
• reproduce.py

Observed behavior:

• control artifact:
  • parses successfully with one bytes_list.value item
• malicious artifact:
  • both files are about 10 MB
  • parses successfully with 5,000,000 bytes_list.value items
  • increases peak RSS by about 198356 kB
  • takes about 45.31x the control parse time

Tested runtime:

• tensorflow==2.21.0
• clean interpreter: /tmp/tf221clean/bin/python

Public files:

• https://huggingface.co/hacnho/tfrecord-feature-byteslist-value-materialization-dos-poc/resolve/main/control_same_size.tfrecords
• https://huggingface.co/hacnho/tfrecord-feature-byteslist-value-materialization-dos-poc/resolve/main/malicious_feature_byteslist_value_5000000.tfrecords
• https://huggingface.co/hacnho/tfrecord-feature-byteslist-value-materialization-dos-poc/resolve/main/reproduce.py

Reproduction:

TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 build_poc.py
TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 reproduce.py