sr64/poc-tflite-micro-pack-axis-oob-cwe125

PoC: heap OOB read in TFLite-Micro PACK kernel via flatbuffer-controlled axis (CWE-125)

Running a crafted TFLite model (.tflite) with a Pack op whose params.axis exceeds the output tensor's rank reads out of bounds in tflite-micro.

Root cause

tensorflow/lite/micro/kernels/pack.cc:

TFLMRegistration Register_PACK() { return RegisterOp(nullptr, nullptr, PackEval); }   // nullptr Prepare
...
const int dimensions = output->dims->size;
if (axis < 0) axis += dimensions;
for (int i = 0; i < axis; ++i) outer_size *= output_dims->data[i];   // :44  reads data[0..axis-1], NO bound

data->axis comes from the .tflite TfLitePackParams. Register_PACK passes nullptr Prepare, so nothing checks axis <= output->dims->size. output_dims is the output tensor's TfLiteIntArray (flatbuffer-backed). The only in-kernel guards are TFLITE_DCHECK_*, no-ops under NDEBUG (release). A crafted .tflite Pack op with axis exceeding the output tensor's rank makes the loop read output_dims->data[i] past the TfLiteIntArray → heap OOB read. (The values_count loop has the same GetEvalInput(node, i) OOB issue when values_count > the operator's input count.) Same systemic release-stripped-DCHECK + nullptr-Prepare pattern as the UNPACK and GATHER kernels, different op and field.

Reproduce (AddressSanitizer)

gcc -fsanitize=address -g -O0 -DNDEBUG tflite_micro_pack_axis_oob_harness.c -o poc && ./poc
# output->dims->size=2 ; attacker axis=8 (nullptr Prepare, DCHECK no-op in release)
# ==ERROR: AddressSanitizer: heap-buffer-overflow  READ of size 4 ... after the dims array

Affected

• Repository: tensorflow/tflite-micro (commit 348eed01b6485f6282b805672ebf1e2a88589830)

Fix

Add a Prepare that validates -output->dims->size <= axis < output->dims->size (and values_count == node->inputs->size) with runtime TF_LITE_ENSURE, instead of the release-stripped TFLITE_DCHECK_*.