Kanisia/tflite-basic-rnn-rank0-oob-read-poc

TFLite BASIC_RNN rank-zero input heap out-of-bounds read

The malicious TFLite model uses the built-in CPU BASIC_RNN operation. It differs from the valid control only in the input tensor shape: the control declares [1, 1], while the malicious model declares a valid FlatBuffer shape vector with zero dimensions, [].

During model loading, InterpreterBuilder turns the zero-length shape into a TfLiteIntArray with a four-byte header and no data elements. BASIC_RNN Prepare then reads input dims data elements zero and one before validating the input rank. The malformed model therefore causes a native heap out-of-bounds read while AllocateTensors prepares the built-in operator.

No Invoke call, GPU, delegate, custom operator, or application-defined code is required. The harness registers TensorFlow Lite's unmodified built-in RNN kernel and calls only ordinary model-building and allocation APIs.

Files

• malicious_basic_rnn_input_rank0.tflite is the uploadable PoC model.
• control_basic_rnn_input_rank2.tflite is the matching valid control.
• Dockerfile, CMakeLists.txt, and asan_harness.cc provide a pinned, CPU-only AddressSanitizer reproduction.
• build_and_verify.py builds the container and checks both outcomes.
• build_poc.py regenerates the TFLite files.
• asan_report.txt, verify_report.json, source_citations.md, and duplicate_check.md record verification and duplicate review.

Reproduction

Docker Desktop with Linux containers is sufficient. No NVIDIA GPU is needed.

python build_and_verify.py

Expected control output:

ALLOCATE_STATUS=0

Expected malicious output includes:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 4
tensorflow/lite/kernels/basic_rnn.cc:80

Root cause

tensorflow/lite/kernels/basic_rnn.cc obtains batch size and unit count from shape-array elements before calling any rank validation for the input, input-weight, recurrent-weight, or bias tensors. BASIC_RNN should validate their expected ranks before reading the dimensions array.

Impact

An attacker who supplies an untrusted TFLite model can trigger a native heap out-of-bounds read during CPU model loading. This PoC demonstrates the read with AddressSanitizer; it does not claim demonstrated code execution, arbitrary memory disclosure, or a write primitive.

Suggested fix

Before any dimensions-array element access in BASIC_RNN Prepare, require ranks of two for the input, input weights, recurrent weights, and hidden state, and rank one for the bias. Return kTfLiteError before deriving batch size or unit count when a malformed shape is supplied.