cntk-v2-protobuf-parser-abort-poc

CNTK v2 Malformed Model Protobuf Parser Abort PoC

This repository contains benign CNTK v2 .model artifacts that demonstrate a native parser abort in CNTK model deserialization. The PoC does not execute code, persist state, access credentials, or make network calls; it only demonstrates a local process abort from a malformed model artifact.

Summary

protobuf_len_ff_abort.model is a 544-byte CNTK v2 model mutated at byte offset 3. The seed control model returns a catchable CNTK error through CNTK_LoadModel, but the malformed artifact aborts the process with free(): invalid pointer before CNTK_LoadModel can return a clean status.

Local reproduction against CNTK 2.7.post2 produced exit status 134 through a shell timeout wrapper, and -6 / SIGABRT through direct Python subprocess execution.

Affected Format

• Format: CNTK v2 serialized model (.model)
• Tested target: CNTK 2.7.post2
• Trigger path: CNTK_LoadModel
• Impact class: native parser abort / process DoS during model load

Artifacts

• artifacts/protobuf_len_ff_abort.model
  • SHA256: e4134ae05d70dac404ae6c008c339d3383852b70c786506e606ecd62f0eb2540
  • Size: 544 bytes
  • Primary abort artifact
• artifacts/seed_control.model
  • SHA256: e5d4249a9f5da52dbb486eb9d3d8d8dd6349e30551d59ed127784fab8fb0082d
  • Size: 544 bytes
  • Non-crashing control used to show a catchable CNTK error path

Generation

The primary artifact was generated from the seed control by changing byte offset 3 from 0x11 to 0xff.

data = bytearray(seed.read_bytes())
data[3] = 0xff
out.write_bytes(data)

The generator used locally is included as src/make_parser_crash_candidate.py.

Reproduction

Build or provide a small CNTK C API loader equivalent to src/load_cntk_model.cpp. Then run:

python verify_cntk_parser_abort.py --harness /path/to/load_cntk_model \
  --cntk-lib /path/to/cntk/libs \
  --openmpi-lib /path/to/openmpi/usr/lib \
  --openmpi-extra-lib /path/to/openmpi/usr/lib/x86_64-linux-gnu

Expected high-level result:

• seed_control.model returns 1 with a clean CNTK status/description.
• protobuf_len_ff_abort.model terminates with SIGABRT (-6) or shell status 134 and prints free(): invalid pointer.

Local Verification Notes

Local verification used:

• CNTK 2.7.post2
• CNTK wheel SHA256: 71133245e10cdc1eca0b44b5fe241b2c97d0c16b8e12425896541a94ab1b5589
• ModelScan 0.8.8

Evidence included:

• evidence/parser_crash_repro_3x.txt: three repeated shell-wrapper runs, all rc 134.
• evidence/parser_seed_control.txt: seed control returns a catchable CNTK plugin-load error.
• evidence/parser_crash_control.txt: primary artifact aborts with free(): invalid pointer.
• evidence/mutation_probe_summary.txt: bounded mutation probe over 1096 variants; 1034 clean loader errors, 62 native signals/aborts, 0 timeouts.

Scanner Behavior

ModelScan 0.8.8 reports zero issues, scans zero files, and skips the .model artifact as unsupported. This is supporting scanner/runtime mismatch evidence only; the primary impact is the native parser abort in CNTK.

Limitation

This is a parser availability issue, not arbitrary code execution. CNTK is an older/deprecated framework, so the strongest submission framing is a model-format parser crash in the latest CNTK release line.