trevdatastreams/armnn-mean-invalid-axis-oob-write-poc

Arm NN native Mean invalid-axis heap OOB write

Arm NN's native FlatBuffers deserializer accepts a MeanDescriptor containing an axis outside the input tensor rank. During normal graph optimization, MeanLayer::InferOutputShapes() subtracts the number of serialized axes from the output rank, but an out-of-range axis never matches an input dimension. The layer writes all four retained dimensions into a three-element vector.

Tested version

• Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820
• Public path: IDeserializer::CreateNetworkFromBinary() then armnn::Optimize()
• Backend: CpuRef
• Instrumentation: AddressSanitizer and UndefinedBehaviorSanitizer

Root cause

ParseMean() copies the attacker-controlled axis vector without validating each value against the input rank:

descriptor.m_Axis =
    std::vector<unsigned int>(flatBufferAxis->begin(), flatBufferAxis->end());

For a rank-four input and a one-element axis vector, shape inference allocates three output dimensions:

outputRank = input.GetNumDimensions() -
             armnn::numeric_cast<unsigned int>(m_Param.m_Axis.size());
std::vector<unsigned int> dimSizes(outputRank, 1);

Axis 100 never matches loop indexes zero through three, so all four input dimensions take the unchecked branch:

dimSizes[outputIndex] =
    armnn::numeric_cast<unsigned int>(input[i]);
++outputIndex;

The fourth write lands immediately after the 12-byte allocation.

Reproduction

./cyber/huntr-mfv/candidates/armnn-flatbuffers-mean-invalid-axis-output-shape-oob-write/reproduce.sh

Three fresh processes per fixture:

Model	Result
control-axis-2.armnn	exit 0, 0, 0
trigger-axis-100.armnn	ASan heap-buffer-overflow, exit 134, 134, 134

Every trigger reports:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4
0 bytes after 12-byte region

Stable image offsets symbolize to:

0x10d7c0 armnn::MeanLayer::InferOutputShapes(...) + 3384
0x10c418 armnn::MeanLayer::ValidateTensorShapesFromInputs() + 740
0x259960 armnn::Graph::InferTensorInfos() + 1160

Differential fixtures

Both files are 552 bytes and differ only at byte offset 249: 0x02 becomes 0x64.

c173e99be9ca68671863274bcfed5212b6ba9f1350c9f552026ac0eb63181023  control-axis-2.armnn
b4610241a7f2803cc03d23f85d6ed6ce588c1b61d5c14dc7d69b7921ca1badf0  trigger-axis-100.armnn

Impact

A malformed native .armnn model can corrupt heap memory and terminate an Arm NN consumer during graph optimization, before inference.

Suggested fix

Reject every Mean axis outside [0, input_rank) and reject duplicate axes before output-rank calculation. Defensively bounds-check outputIndex during shape construction.

Prior-art distinction

Automated Hugging Face and local scans returned zero matches, and the only GitHub result was unrelated. Manual source-signature and web searches found no native Mean occurrence. An earlier submitted report affects ReduceLayer.cpp; this occurrence has a different FlatBuffers schema layer, parser function, descriptor type, source file, sink symbol, and fix site.