opencv-darknet-groups-zero-sigfpe-poc

OpenCV DNN Darknet groups=0 SIGFPE PoC

This repository contains a benign Darknet .cfg model artifact that demonstrates an OpenCV DNN Darknet importer denial-of-service issue. The PoC does not execute code, persist state, access credentials, or make network calls; it only demonstrates a native SIGFPE crash in a local model loader.

Summary

groups_zero_conv.cfg defines a minimal Darknet network with a [convolutional] block containing groups=0. When OpenCV DNN imports the model, the Darknet parser reads groups from the model-controlled config and reaches a modulo/division operation using that value. The tested wheel, opencv-python-headless==4.13.0.92, exits with SIGFPE when loading the artifact through both explicit Darknet APIs and generic cv2.dnn.readNet(...) paths.

Local ASAN evidence maps the signal to OpenCV's Darknet cfg parser. Source review points to modules/dnn/src/darknet/darknet_io.cpp, where groups is read from the model config and used in tensor_shape[0] % groups / tensor_shape[0] / groups without first validating groups > 0.

Affected Format

• Format: Darknet model config (.cfg) with companion weights header
• Tested target: opencv-python-headless==4.13.0.92
• Trigger paths:
  • cv2.dnn.readNetFromDarknet(cfg)
  • cv2.dnn.readNetFromDarknet(cfg, weights)
  • cv2.dnn.readNetFromDarknet(bytearray(cfg), ...)
  • cv2.dnn.readNet(cfg)
  • cv2.dnn.readNet(cfg, weights)
• Impact class: native SIGFPE / process DoS during model import

Artifacts

• artifacts/groups_zero_conv.cfg
  • SHA256: bf20ae166213003e112e9fa85a078e12d0325c5c4050aab35626601c1bc568ab
  • Primary SIGFPE artifact
• artifacts/header_only.weights
  • SHA256: 2d42634a033bb4952d353d7e9b896478a7e1f2553888199f8df89e42ca2c281b
  • Minimal Darknet weights header used for API paths that expect weights

Reproduction

Install OpenCV, then run:

python verify_darknet_groups_zero_sigfpe.py

Expected high-level result:

• groups_zero_conv.cfg returns SIGFPE (-8 through Python subprocess, shell status 136) across the importer paths.

Manual minimal reproduction:

python - <<'PY'
import cv2
cv2.dnn.readNetFromDarknet("artifacts/groups_zero_conv.cfg", "artifacts/header_only.weights")
PY

Scanner Behavior

ModelScan 0.8.8 reports zero issues and scans zero files for these Darknet artifacts. This is not presented as a scanner bypass by itself because Darknet is unsupported. The security impact comes from a current real loader reaching native unsafe arithmetic from model-controlled fields.

Evidence

The evidence/ directory contains captured local outputs, including ASAN output for the SIGFPE and scanner output.

Limitation

This is a native process crash in a model importer, not arbitrary code execution.