| # TensorFlow HDF5 Security Research PoCs |
|
|
| This repository contains proof-of-concept `.h5` model files for an authorized |
| security audit under the huntr Model Format Vulnerability program (beta). These |
| artifacts are for defensive validation and coordinated disclosure only, not for |
| any production or general-purpose use. |
|
|
| ## Summary |
|
|
| The bundle currently contains three independent PoCs against TensorFlow's |
| legacy Keras HDF5 loading path in the audited source tree |
| (`1d0f0c1c525442f9bb0e219ea4714ff94e56b374`): |
|
|
| 1. `legacy_lambda_rce.h5` |
| - Demonstrates benign load-time code execution by writing a fixed marker file |
| in `/tmp`. |
| 2. `cyclic_inbound_nodes_dos.h5` |
| - Demonstrates a load-time hang from cyclic Functional graph replay. |
| 3. `oversized_weight_allocation_dos.h5` |
| - Demonstrates load-time allocation pressure from a tiny HDF5 file with a |
| huge declared logical tensor. |
| |
| ## Files |
|
|
| - `legacy_lambda_rce.h5`, `legacy_lambda_rce.py`, `legacy_lambda_rce_clean_repro.txt` |
| - `cyclic_inbound_nodes_dos.h5`, `cyclic_inbound_nodes_dos.py`, `cyclic_inbound_nodes_dos_repro.txt` |
| - `oversized_weight_allocation_dos.h5`, `oversized_weight_allocation_dos.py`, `oversized_weight_allocation_dos_repro.txt` |
|
|
| ## Reproduction |
|
|
| Tested on July 29, 2026. |
|
|
| Run each PoC through the public `tf.keras.models.load_model()` API from a |
| network-disabled container with: |
|
|
| ```bash |
| TF_USE_LEGACY_KERAS=1 python3 <poc_script.py> <mode> |
| ``` |
|
|
| Where: |
|
|
| - `legacy_lambda_rce.py` generates and reproduces in one run, |
| - `cyclic_inbound_nodes_dos.py` uses `generate` and `repro` modes, |
| - `oversized_weight_allocation_dos.py` uses `generate` and `repro` modes. |
|
|
| ## Note |
|
|
| These artifacts are intended only for defensive validation and coordinated |
| disclosure workflows. |
|
|
