File size: 2,631 Bytes
a180a74 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | ---
license: mit
tags:
- security
- proof-of-concept
- mleap
- denial-of-service
---
# MLeap TensorFlow `GraphDef` native-crash PoC
This repository contains a proof-of-concept malicious `.mleap` file for a responsibly-disclosed
vulnerability in [`combust/mleap`](https://github.com/combust/mleap) (tested at commit
`88de54dd4fb7720c7c56ff5c2b51cdec4353a128`), reported via huntr's Model File Vulnerability
program.
## What this file is
`tf_crash_poc.zip` is a syntactically valid, standard-format `.mleap` bundle (built with MLeap's
own `BundleWriter`, not hand-crafted) containing a single root `tensorflow` node whose embedded
`graph.pb` is **0 bytes** — a syntactically valid, trivially empty TensorFlow `GraphDef` protobuf
message — and which declares **zero** input/output tensors and no target nodes.
## What happens when you load it
```scala
import ml.combust.bundle.BundleFile
import ml.combust.mleap.runtime.MleapSupport._
import ml.combust.mleap.runtime.MleapContext.defaultContext
import ml.combust.mleap.runtime.frame.DefaultLeapFrame
import ml.combust.mleap.core.types.StructType
val bundle = BundleFile(new java.io.File("tf_crash_poc.zip")).loadMleapBundle().get
val transformer = bundle.root
val emptyFrame = DefaultLeapFrame(StructType(Seq()).get, Seq(ml.combust.mleap.runtime.frame.Row()))
transformer.transform(emptyFrame) // <-- crashes the JVM here
```
Loading the bundle succeeds without error (MLeap performs no validation of the embedded graph
bytes at load time). Running inference on it — the ordinary, expected way to use a loaded MLeap
pipeline — triggers a **native access violation** inside TensorFlow's own C API:
```
# A fatal error has been detected by the Java Runtime Environment:
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00007ffc6f92f3f7, ...
# The crash happened outside the Java Virtual Machine in native code.
```
with the fault located precisely in `TF_GraphImportGraphDef`, called from
`ml.combust.mleap.tensorflow.TensorflowModel.getSessionFromFrozenGraph()`. See
`verification-log.txt` in this repository for the full, unmodified crash output and stack trace
from the reporter's own reproduction, and the reporter's full write-up submitted via huntr for the
complete technical analysis.
This is **not** a catchable Java exception — no `try`/`catch(Throwable)` at any level of a calling
application can prevent the JVM process from terminating.
## Scope note
This PoC is provided solely for the purpose of responsible vulnerability disclosure and
reproduction by the `mleap` maintainers / huntr triage team. It is not intended for any other use.
|