hacnho/onnxruntime-zero-stride-sigfpe-poc

ONNX Runtime zero-stride SIGFPE PoC

This repository contains a benign model-file vulnerability proof of concept for authorized Huntr MFV triage.

ONNX Runtime InferenceSession crashes with native SIGFPE when loading tiny ONNX models whose Conv or AveragePool node declares strides=[0,1]. Equivalent benign controls with strides=[1,1] load normally.

The malicious models include explicit output shapes. They pass basic onnx.checker.check_model(). ONNX checker.check_model(..., full_check=True) returns a handled ShapeInferenceError, while ONNX Runtime terminates the process during InferenceSession creation.

Files

• models/control_conv_stride_one.onnx - benign Conv control.
• models/malicious_conv_stride_zero.onnx - zero-stride Conv crash case.
• models/control_averagepool_stride_one.onnx - benign AveragePool control.
• models/malicious_averagepool_stride_zero.onnx - zero-stride AveragePool crash case.
• reproduce.py - bounded reproducer. Use --model-dir models to verify the exact ONNX files in this repository, or omit it to regenerate equivalent models into the output directory.
• requirements.txt - tested Python dependencies.

Tested Versions

• onnxruntime==1.24.4
• onnx==1.22.0
• Python: /usr/bin/python3
• Provider: CPUExecutionProvider

Reproduction

python3 -m pip install -r requirements.txt
python3 reproduce.py --model-dir models --out-dir /tmp/ort-zero-stride-poc --timeout 6 --memory-mb 1024

Expected result:

control_conv_stride_one -> returncode 0
malicious_conv_stride_zero -> returncode -8, signal_name SIGFPE
control_averagepool_stride_one -> returncode 0
malicious_averagepool_stride_zero -> returncode -8, signal_name SIGFPE

The reproducer runs each model in a subprocess with a 6 second timeout, RLIMIT_AS=1024 MB, core dumps disabled, and single-threaded ONNX Runtime session options.

Impact

A crafted ONNX file can terminate any service that loads untrusted or user-supplied ONNX models through ONNX Runtime InferenceSession. The crash occurs during session creation, before application code can catch a Python exception.

This PoC does not execute code, access secrets, or require external network access. It only demonstrates a local availability impact from attacker-controlled model metadata.

Scope note

This PoC is intended to demonstrate an ONNX Runtime loader/runtime bug, not a generic ONNX shape-inference issue.

• ONNX checker.check_model(..., full_check=True) returns a handled ShapeInferenceError for these zero-stride models.
• ONNX Runtime InferenceSession(...) in onnxruntime==1.24.4 still terminates the process with native SIGFPE.

It is also distinct from the already-open public ONNX DepthToSpace ... SIGFPE findings tracked in the reporter's own Huntr dashboard. Those findings make generic crash-class terms such as SIGFPE noisy for self-duplicate searches; the main distinguishing terms for this candidate are InferenceSession, zero stride, and strides=[0,1].