onnx-dos-poc

ONNX Shape Inference Stack Overflow (DoS) - PoC

⚠️ SECURITY RESEARCH - DO NOT LOAD THIS MODEL OUTSIDE A SANDBOX

Vulnerability Summary

Title: Unbounded Recursion in shape_inference::TraverseGraphsToAddExistingSymbols leads to Stack Overflow (DoS)

Affected Library: ONNX (onnx/shape_inference/implementation.cc)

Severity: High (Denial of Service)

Description

The function TraverseGraphsToAddExistingSymbols recursively traverses subgraphs without any depth limit. An attacker can create a malicious ONNX model with deeply nested If nodes and call onnx.shape_inference.infer_shapes(). This causes the C++ stack to overflow, resulting in a Segmentation Fault and crashing the inference server.

Steps to Reproduce

1. Load crash_model.onnx using onnx.load().
2. Call onnx.shape_inference.infer_shapes(model).
3. Program crashes with "Fatal Python error: Cannot recover from stack overflow".

Impact

Denial of Service (DoS). An attacker can crash any service that performs shape inference on untrusted ONNX models.

Files

• crash_model.onnx - Malicious ONNX model with nested If nodes