| tags: | |
| - security | |
| - proof-of-concept | |
| - tfrecords | |
| license: mit | |
| # TFRecords SequenceExample feature_list materialization DoS PoC | |
| This repository contains a benign security research PoC for a `.tfrecords` | |
| artifact that drives large protobuf materialization during | |
| `tf.train.SequenceExample.FromString(...)`. | |
| Files: | |
| - `control_same_size.tfrecords` | |
| - `malicious_sequenceexample_featurelist_2000000.tfrecords` | |
| - `reproduce.py` | |
| Observed behavior: | |
| - control artifact: | |
| - parses successfully with one feature entry | |
| - malicious artifact: | |
| - same size as control | |
| - parses successfully with `2,000,000` feature entries | |
| - increases peak RSS by about `269648 kB` | |
| - takes about `37.58x` the control parse time | |
| Tested runtime: | |
| - `tensorflow==2.21.0` | |
| - clean interpreter: `/tmp/tf221clean/bin/python` | |
| Public files: | |
| - `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/control_same_size.tfrecords` | |
| - `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/malicious_sequenceexample_featurelist_2000000.tfrecords` | |
| - `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/reproduce.py` | |
| Reproduction: | |
| ```bash | |
| TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 build_poc.py | |
| TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 reproduce.py | |
| ``` | |