| --- |
| license: mit |
| tags: |
| - security |
| - proof-of-concept |
| - mleap |
| - denial-of-service |
| --- |
| |
| # MLeap TensorFlow `GraphDef` native-crash PoC |
|
|
| This repository contains a proof-of-concept malicious `.mleap` file for a responsibly-disclosed |
| vulnerability in [`combust/mleap`](https://github.com/combust/mleap) (tested at commit |
| `88de54dd4fb7720c7c56ff5c2b51cdec4353a128`), reported via huntr's Model File Vulnerability |
| program. |
|
|
| ## What this file is |
|
|
| `tf_crash_poc.zip` is a syntactically valid, standard-format `.mleap` bundle (built with MLeap's |
| own `BundleWriter`, not hand-crafted) containing a single root `tensorflow` node whose embedded |
| `graph.pb` is **0 bytes** — a syntactically valid, trivially empty TensorFlow `GraphDef` protobuf |
| message — and which declares **zero** input/output tensors and no target nodes. |
|
|
| ## What happens when you load it |
|
|
| ```scala |
| import ml.combust.bundle.BundleFile |
| import ml.combust.mleap.runtime.MleapSupport._ |
| import ml.combust.mleap.runtime.MleapContext.defaultContext |
| import ml.combust.mleap.runtime.frame.DefaultLeapFrame |
| import ml.combust.mleap.core.types.StructType |
| |
| val bundle = BundleFile(new java.io.File("tf_crash_poc.zip")).loadMleapBundle().get |
| val transformer = bundle.root |
| val emptyFrame = DefaultLeapFrame(StructType(Seq()).get, Seq(ml.combust.mleap.runtime.frame.Row())) |
| transformer.transform(emptyFrame) // <-- crashes the JVM here |
| ``` |
|
|
| Loading the bundle succeeds without error (MLeap performs no validation of the embedded graph |
| bytes at load time). Running inference on it — the ordinary, expected way to use a loaded MLeap |
| pipeline — triggers a **native access violation** inside TensorFlow's own C API: |
|
|
| ``` |
| # A fatal error has been detected by the Java Runtime Environment: |
| # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00007ffc6f92f3f7, ... |
| # The crash happened outside the Java Virtual Machine in native code. |
| ``` |
|
|
| with the fault located precisely in `TF_GraphImportGraphDef`, called from |
| `ml.combust.mleap.tensorflow.TensorflowModel.getSessionFromFrozenGraph()`. See |
| `verification-log.txt` in this repository for the full, unmodified crash output and stack trace |
| from the reporter's own reproduction, and the reporter's full write-up submitted via huntr for the |
| complete technical analysis. |
|
|
| This is **not** a catchable Java exception — no `try`/`catch(Throwable)` at any level of a calling |
| application can prevent the JVM process from terminating. |
|
|
| ## Scope note |
|
|
| This PoC is provided solely for the purpose of responsible vulnerability disclosure and |
| reproduction by the `mleap` maintainers / huntr triage team. It is not intended for any other use. |
|
|
