arm-nn-flatbuffers-dimension-specificity-oob-poc

Arm NN FlatBuffers dimensionSpecificity PoC

This is a benign security research PoC for an Arm NN SerializedGraph FlatBuffers artifact. It does not execute code, make network connections, or modify files.

Summary

Arm NN's serialized network schema stores tensor dimensional specificity as an unbounded FlatBuffers vector:

dimensionSpecificity:[bool]

Current Arm NN deserializer source copies that vector into a fixed stack array sized by armnn::MaxNumOfTensorDimensions, which is 5. The provided .armnn artifact is structurally valid FlatBuffers data but sets dimensionSpecificity to 64 booleans on a one-dimensional input tensor. A focused C++ harness mirroring the Arm NN copy loop confirms the verifier/runtime semantic mismatch by trapping on index 5 of bool[5].

Files

• armnn_dim_specificity_oob.armnn: benign Arm NN FlatBuffers artifact.
• armnn_dim_specificity_oob.json: source JSON used to build the artifact.
• ArmnnSchema.fbs: Arm NN schema snapshot used for artifact generation.
• flatc_roundtrip.json: flatc -t --raw-binary output from the artifact.
• verify_poc.py: lightweight local verifier for artifact hash, size, and optional flatc roundtrip.
• verify_armnn_dimension_specificity.cpp: focused C++ harness that mirrors the Arm NN copy loop.
• harness_stdout.txt / harness_stderr.txt: captured harness result.
• modelscan_output.txt: captured ModelScan output.
• results.json: machine-readable summary.

Reproduction

Basic verification:

python verify_poc.py

Optional FlatBuffers roundtrip, if flatc is installed:

FLATC=/path/to/flatc python verify_poc.py

Harness reproduction used locally:

flatc --cpp -o generated ArmnnSchema.fbs
python -m ziglang c++ -std=c++17 -w -O0 -I/path/to/flatbuffers/include -Igenerated verify_armnn_dimension_specificity.cpp -o verify_armnn_dimension_specificity
./verify_armnn_dimension_specificity armnn_dim_specificity_oob.armnn

Expected output:

flatbuffers_verifier=PASS
dimensions_size=1
dimensionSpecificity_size=64
thread ... panic: index 5 out of bounds for type 'bool[5]'

Scanner Output

ModelScan 0.8.8 reported zero issues and scanned zero files for the .armnn artifact:

"total_issues": 0
"scanned": {"total_scanned": 0}

This should be treated as a scanner coverage gap unless a full Arm NN deserializer build confirms runtime impact.

Versions

• Arm NN source: f8beb5a9d50451dd06c804d6f7bbf8832f958125
• FlatBuffers / flatc: 25.12.19
• ModelScan: 0.8.8
• Python: 3.13.13

Artifact Hash

SHA256: 9d01bfbed64946b533f26dbac0a47957ecb33e75d4a209626e7cdc240f122907
Size: 500 bytes

Security Impact

Potential native parser memory-safety issue or deserializer DoS when an untrusted Arm NN SerializedGraph artifact is loaded. This is not arbitrary code execution as packaged.

Limitations

This package is a candidate, not a final bounty submission. It has current-source evidence and a focused harness, but still needs validation against a full Arm NN deserializer binary, ideally with ASAN/UBSAN on Linux or Android. Arm NN is also currently described by its README as a legacy project recommended only for trusted contexts, which may reduce bounty eligibility.

Suggested Mitigation

Reject dimensionSpecificity vectors longer than armnn::MaxNumOfTensorDimensions before copying, and reject tensors whose dimensions and dimensionSpecificity lengths differ when dimensionSpecificity is present.