onnx-inliner-mutual-recursion-dos

ONNX Inliner Mutual Recursion DoS (SIGSEGV)

Vulnerability Summary

CWE-674: Uncontrolled Recursion

The ONNX library's function inliner (onnx.inliner.inline_local_functions()) crashes with SIGSEGV (stack overflow) when processing models containing mutually recursive functions.

Affected Component

• Package: onnx (NOT onnxruntime)
• Function: onnx.inliner.inline_local_functions()
• Vulnerable Code: onnx/inliner/inliner.cc:606
• Tested Version: onnx 1.18.0

Root Cause

In inliner.cc, the append_node() function (line 581-606) recursively processes function calls without:

1. Cycle detection for mutual recursion
2. Depth limit for recursion

When Function A calls Function B, and Function B calls Function A, the inliner infinitely recurses until stack overflow.

Reproduction

pip install onnx

# Download PoC
wget https://huggingface.co/Yash1106/onnx-inliner-mutual-recursion-dos/resolve/main/mutual_recursion_poc.onnx
wget https://huggingface.co/Yash1106/onnx-inliner-mutual-recursion-dos/resolve/main/poc_mutual_recursion.py

# Run PoC
python3 poc_mutual_recursion.py
# Expected: Exit code 139 (SIGSEGV)

Or minimal reproduction:

import onnx
from onnx import inliner

model = onnx.load("mutual_recursion_poc.onnx")
inliner.inline_local_functions(model)  # CRASHES with SIGSEGV

Impact

• Denial of Service: Any application using inline_local_functions() on untrusted models can be crashed
• Exit Code: 139 (SIGSEGV - Segmentation Fault)

Technical Details

The malicious model contains:

• FunctionA which calls FunctionB
• FunctionB which calls FunctionA
• Main graph calls FunctionA

When inliner processes this:

1. Encounters FunctionA call → inlines FunctionA
2. FunctionA contains FunctionB call → inlines FunctionB
3. FunctionB contains FunctionA call → inlines FunctionA
4. ... infinite recursion → stack overflow → SIGSEGV

Note

The ONNX checker (onnx.checker.check_model()) does NOT detect mutual recursion - it passes validation.