| --- |
| tags: |
| - security |
| - proof-of-concept |
| - surrealml |
| --- |
| |
| # SurrealML process-abort PoC (`load_model` / embedded NUL byte) |
| |
| This repository contains a proof-of-concept `.surml` file for a responsibly-disclosed |
| vulnerability in [`surrealdb/surrealml`](https://github.com/surrealdb/surrealml) (tested at commit |
| `152ac2d508f1bae9ee62c46b7d211d80e40a6425`), reported via huntr's Model File Vulnerability |
| program. |
| |
| ## What this file is |
| |
| `malicious_nul_name.surml` is a syntactically valid (but minimal) SurrealML container: a 4-byte |
| big-endian header-length prefix, a header whose `name` field is the literal string |
| `evil\x00name` (a raw embedded NUL byte, all other header fields left empty/fresh), and 16 bytes |
| of placeholder model data. It follows exactly the header format documented and unit-tested in the |
| project's own `modules/core/src/storage/header/mod.rs`. |
| |
| ## What happens when you load it |
| |
| ```python |
| import ctypes |
| lib = ctypes.CDLL("libc_wrapper.so") # or .dll / .dylib |
| lib.load_model(b"malicious_nul_name.surml") |
| ``` |
| |
| `load_model()` reads and parses the file successfully (the header format tolerates an embedded |
| NUL byte fine), then panics while converting the `name` field to a C string |
| (`CString::new(name).unwrap()` at `modules/c-wrapper/src/api/storage/load_model.rs:124`), since a |
| `CString` cannot represent an interior NUL byte. Because `load_model` is a plain `extern "C" fn` |
| rather than `extern "C-unwind"`, this panic aborts the entire host process — it cannot be caught |
| as an exception by a Python/Node/etc. caller, and no error result is ever returned. |
|
|
| A single ~65-byte file is enough to kill any process that calls `load_model()` on it — no |
| inference, no other API call required. |
|
|
| See the reporter's full write-up submitted via huntr for the complete technical analysis, the |
| related prior-art discussion (GitHub issue |
| [surrealdb/surrealml#20](https://github.com/surrealdb/surrealml/issues/20), a similar |
| "malformed file crashes the whole server" report from 2024 that was reopened after an incomplete |
| fix), and a second, unrelated finding (a use-after-free in the Python client's `to_bytes()`). |
|
|
| ## Scope note |
|
|
| This PoC is provided solely for the purpose of responsible vulnerability disclosure and |
| reproduction by the `surrealml` maintainers / huntr triage team. It is not intended for any other |
| use. |
|
|
