trevdatastreams/circle-mlir-intermediate-index-oob-poc

Samsung ONE Circle-MLIR unchecked intermediate tensor index

This repository contains a benign denial-of-service proof of concept for responsible disclosure through Huntr's Model File Vulnerability program. The artifact does not execute commands, access data, or make network requests. It only crashes the local Circle importer.

Summary

The Circle-MLIR importer trusts every integer in an operator's intermediates vector as an index into the subgraph's tensor vector. CircleImport.cpp dereferences subgraph.tensors[intermediate] without first checking that the index is non-negative and smaller than subgraph.tensors.size().

An attacker-controlled .circle file with five tensors and an intermediate index of 2147483647 deterministically crashes circle_impexp during model import. A differential control with the same graph and valid intermediate index 4 imports successfully.

Tested upstream state:

• Repository: Samsung/ONE
• Commit: 342395fc0d6bf29e2ea939ef0a7eced18d677f81
• Commit date: 2026-07-10
• Tool: circle_impexp, built from circle-mlir
• Toolchain image: nnfw/circle-mlir-build:jammy

Root cause

circle-mlir/circle-mlir/lib/import/src/CircleImport.cpp:895-899:

for (auto intermediate : op->intermediates)
{
  ASSIGN_OR_RETURN(auto type, GetTensorType(*subgraph.tensors[intermediate], builder,
                                            /*is_constant=*/false,
                                            /*is_intermediate=*/true));
  intermediate_types.emplace_back(type);
}

The Operator.intermediates field is stored directly in the Circle FlatBuffer. The parser performs no range check before std::vector::operator[] and the subsequent pointer dereference.

Differential PoC

Both artifacts are 724-byte CIR0 FlatBuffers generated with Samsung ONE's Circle 0.9 schema.

File	intermediates[0]	Tensor count	SHA-256	Result
control.circle	4	5	955d642e8e450e553c5c03333ffd5d6d8b773984efeba7e1f1e80c46ba1168c8	Exit 0
trigger.circle	2147483647	5	6a8305d7eba550c2e8d3ba12bc00730ea692de6c8db55e970da71fe5cccff9d7	SIGSEGV, exit 139

The JSON sources and deterministic generator are included. The only security-relevant difference is the intermediate tensor index.

Reproduction

Clone the tested source and include the two sparse paths needed by the build:

git clone --depth=1 --filter=blob:none --sparse \
  https://github.com/Samsung/ONE.git ONE
git -C ONE sparse-checkout set circle-mlir res/CircleSchema
git -C ONE checkout 342395fc0d6bf29e2ea939ef0a7eced18d677f81
docker pull nnfw/circle-mlir-build:jammy
./reproduce.sh /absolute/path/to/ONE

Expected result:

control exit: 0
trigger exit: 139

The included evidence-unmodified-debug-3x.log records three clean control runs followed by three trigger crashes from an unmodified debug build:

CONTROL_RUN_1=0
CONTROL_RUN_2=0
CONTROL_RUN_3=0
TRIGGER_RUN_1=139
TRIGGER_RUN_2=139
TRIGGER_RUN_3=139

Impact

Any service or build pipeline that imports an untrusted Circle model through this path can be terminated by a tiny model file. The crash occurs during model parsing, before inference, and requires no plugin, custom operator, or external resource.

This is an out-of-bounds vector read followed by an invalid pointer dereference (CWE-125). The demonstrated impact is denial of service. No claim of code execution is made.

Suggested fix

Reject negative and out-of-range intermediate indices before dereferencing:

for (auto intermediate : op->intermediates)
{
  if (intermediate < 0 ||
      static_cast<size_t>(intermediate) >= subgraph.tensors.size())
  {
    llvm::errs() << "Invalid intermediate tensor index " << intermediate << "\n";
    return {};
  }
  // Existing conversion follows.
}

Add regression coverage for -1, tensor_count, and INT32_MAX.

Prior-art check

Before constructing the PoC, searches were run across Hugging Face security repositories, Samsung/ONE GitHub issues and pull requests, the local candidate registry, and four semantic web queries. No report matching the Operator.intermediates tensor-index sink was found.

Known public Circle findings involving constant buffer indices, operator output indices, transpose permutations, and extended-buffer arithmetic are different attacker-controlled fields and different sinks.