cntk-v2-native-udf-model-load-poc

CNTK v2 Native UDF Model-Driven Library Load PoC

This repository contains a benign marker-only PoC for CNTK v2 model deserialization behavior. The PoC does not access credentials, make network calls, persist beyond a local marker file, or run destructive commands.

The primary model artifact, valid_native_udf.model, contains a NativeUserDefinedFunction whose serialized state names a native module and a deserialize method. When CNTK loads the model, it calls dlopen() for the model-specified module. The companion library writes a benign marker string and returns a valid CNTK native UDF, so CNTK_LoadModel completes successfully after the model-driven native library load.

Affected Format

• Format: CNTK v2 .model
• Tested runtime: CNTK 2.7
• Trigger path: CNTK_LoadModel
• Primary artifact: valid_native_udf.model
• Primary impact: model-carried native library load during model deserialization

Security Impact

An untrusted CNTK v2 model can carry NativeUserDefinedFunction metadata that causes the CNTK loader to load a native library path selected by the model artifact. In this PoC, the native library is benign and writes only CNTK_VALID_NATIVE_UDF_MARKER, but the behavior demonstrates model-driven native code execution at load time.

This is not a generic "pickle is unsafe" issue. The trigger is CNTK's own model deserialization path for a CNTK v2 model containing a native UDF.

Files

• valid_native_udf.model: primary PoC. Uses module = ./valid_marker_udf, writes a benign marker, returns a real UserTimesFunction, and CNTK_LoadModel returns success.
• valid_marker_udf.so: benign marker-only native library that also returns a valid CNTK native UDF.
• model.model: supporting variant. Uses module = ./benign_udf, relying on CNTK to append .so.
• model_missing_symbol.model: same native module, but with a nonexistent deserialize_method. The marker still fires before CNTK fails on symbol lookup.
• model_subdir_relative.model: uses module = plugins/benign_udf.so.
• benign_udf.so: benign marker-only native library for the supporting failure-after-load variants.
• plugins/benign_udf.so: same library for the subdirectory-relative model.
• src/: source used to generate/build the local artifacts.
• evidence/: captured local runtime output.

Artifact Hashes

• valid_native_udf.model: 45ac0b171c546fe093b7a54339249b1c577bb1fa0a2ad3d2656b5ba0620ed7a5
• valid_marker_udf.so: 551bd8df921cfa037e899cce064b326fabbd50864dd39417157da1fd2e3a3dbe
• model.model: e5d4249a9f5da52dbb486eb9d3d8d8dd6349e30551d59ed127784fab8fb0082d
• model_missing_symbol.model: 1e92dccb7481f59c89c64d9738764f7bf00b7e9bf86bae7f7a8b07925a96dc54
• model_subdir_relative.model: 3889047a5f044d650dc70c2586e75121ff8ef4a2ef49e2dea917d6ae857afb91

Expected Safe Impact

The original library constructor writes CNTK_NATIVE_UDF_MARKER to cntk_native_udf_marker.txt, or to the path specified by CNTK_UDF_MARKER. The valid-return library writes CNTK_VALID_NATIVE_UDF_MARKER through the same environment-controlled marker path.

No network, persistence, credential access, or destructive behavior is used.

Local Verification

From /workspace/cntk-v2, after the CNTK 2.7 runtime harness has been prepared:

hf_cntk_v2_poc/verify.sh valid_native_udf.model
lab/verify_native_udf_bundle.sh hf_cntk_v2_poc model.model
lab/verify_native_udf_bundle.sh hf_cntk_v2_poc model_missing_symbol.model
lab/verify_native_udf_bundle.sh hf_cntk_v2_poc model_subdir_relative.model

Successful proof for valid_native_udf.model is:

CNTK_LoadModel status=0
loader_status=0
marker_created=yes
CNTK_VALID_NATIVE_UDF_MARKER

The other variants prove that library constructors run before CNTK reports later deserialize errors, and that relative/subdirectory module paths are honored.

Scanner Check

.venv-scan/bin/modelscan scan -p hf_cntk_v2_poc --show-skipped -r json -o outputs/modelscan_hf_cntk_v2_poc_valid.json

ModelScan 0.8.8 skips these CNTKv2 and .so artifacts as unsupported and reports zero issues.

Limitation

CNTK native UDFs are an extensibility feature. The reportable issue is the risk created when untrusted model files are loaded or scanned as model artifacts while the model can direct native library loading during deserialization.