| # Arm NN TFLite DetectionPostProcess malformed FlexBuffer PoC |
|
|
| This repository demonstrates a load-time heap-buffer-overflow read in Arm NN's |
| TFLite parser. A verifier-valid `.tflite` model can provide a one-byte |
| `custom_options` vector for the `TFLite_Detection_PostProcess` custom operator. |
| Arm NN passes that vector directly to `flexbuffers::GetRoot(...).AsMap()` |
| without first validating the FlexBuffer. |
|
|
| ## Tested version |
|
|
| - Arm NN commit: |
| `2b61cecc9df7a43fca1463795062cf359e6be820` |
| - Commit date: 2026-07-02 |
| - Parser library: `libarmnnTfLiteParser.24.7.dylib` |
| - FlatBuffers compiler: 24.3.25 |
| - Instrumentation: Clang AddressSanitizer and UndefinedBehaviorSanitizer |
|
|
| ## Root cause |
|
|
| `src/armnnTfLiteParser/TfLiteParser.cpp` copies attacker-controlled custom |
| options and parses them without a FlexBuffers verifier: |
|
|
| ```cpp |
| auto custom_options = operatorPtr->custom_options; |
| const flexbuffers::Map& m = |
| flexbuffers::GetRoot(custom_options.data(), custom_options.size()).AsMap(); |
| ``` |
|
|
| `flexbuffers::GetRoot` reads the root byte-width and packed type from the end |
| of the supplied buffer. A one-byte vector has no room for both values, so the |
| first access reads one byte before the allocation. |
|
|
| The outer TFLite FlatBuffer is valid. The TFLite verifier checks the |
| `custom_options` vector as a byte vector but does not validate its nested |
| FlexBuffer encoding. |
|
|
| ## Differential fixtures |
|
|
| - `control.tflite` contains the upstream test's valid DetectionPostProcess |
| FlexBuffer and loads successfully. |
| - `trigger.tflite` is the same model structure with `custom_options` reduced |
| to the single byte `0x00`. |
|
|
| SHA-256: |
|
|
| ```text |
| b1828036d5ace9f157f1a1b34a0ad94614989d8b227f127f146af5c3e332e704 control.tflite |
| af9c5e86ab6973b87eb78ad17573f79739e01dcf7e17e0d50348ce95a82a185f trigger.tflite |
| ``` |
|
|
| ## Reproduction |
|
|
| Build Arm NN's TFLite parser with ASan/UBSan, then run: |
|
|
| ```bash |
| ./reproduce.sh |
| ``` |
|
|
| Expected control result: |
|
|
| ```text |
| loaded 1280 bytes |
| ``` |
|
|
| Expected trigger result: |
|
|
| ```text |
| ERROR: AddressSanitizer: heap-buffer-overflow |
| READ of size 1 |
| ... in armnnTfLiteParser::TfLiteParserImpl::ParseDetectionPostProcess |
| 0x... is located 1 bytes before 1-byte region |
| ``` |
|
|
| The included `repeated-results.txt` records three independent runs. Every |
| control exited `0`; every trigger exited `134` with the same ASan signature. |
|
|
| ## Impact |
|
|
| Any service, model inspection pipeline, or application that imports an |
| attacker-supplied TFLite DetectionPostProcess model through Arm NN can be |
| terminated during model loading. The invalid nested encoding reaches native |
| out-of-bounds memory access before inference. |
|
|
| This PoC demonstrates denial of service through a native out-of-bounds read. |
| It does not claim code execution or data disclosure. |
|
|
| ## Suggested remediation |
|
|
| Validate `custom_options` with the FlexBuffers verifier before calling |
| `GetRoot`, and reject buffers that are too short to contain a root reference. |
| The parser should also validate that the root is a map and that required keys |
| have the expected scalar types before reading descriptor fields. |
|
|
| ## Research safety |
|
|
| The fixtures are synthetic and operate only on a local instrumented build. |
| No hosted service or third-party system is contacted. |
|
|
