ONNX RNN/GRU/LSTM Out-of-Bounds Read (Missing Rank Check in Old Opsets) Analysis & POC

Vulnerability Summary: Out-of-Bounds Read in RNN/GRU/LSTM Model Inference (Legacy Opsets, Missing Rank Checks) Vulnerability Overview During ONNX model inference, when using multi-form RNN, GRU, or LSTM operators to process inputs from Opset version 1.4 or earlier, the absence of rank checks on input tensors can lead to out-of-bounds reads. This vulnerability allows attackers to trigger reads of uninitialized memory by crafting malicious inputs, resulting in data leakage or anomalous model behavior. Scope of Impact Affected Versions: - ONNX 1.2.0 and earlier - ONNX 1.2.1 - ONNX Runtime 1.4 and earlier versions supporting RNN/GRU/LSTM (Opset 3–6) Severity Level: Medium (CVSS 3.1: 5.3) Affected Components: ONNX model inference engine (specifically recurrent neural network operators under legacy Opsets) Remediation Upgrade to ONNX 1.2.2 or later Verification: - An official patch has been released (PR #3007) - Fix details: Added rank check logic before input tensors enter the model - Verification method: Confirm the fix is effective using the official test cases (test_rnn.py) POC / Exploit Code > ⚠️ Warning: The code above is a conceptual demonstration. Actual exploitation requires adaptation to specific models and runtime environments. Do not execute unauthorized tests in production environments. Additional Information CVE ID: CVE-2021-11919 Disclosure Date: October 15, 2021 Fix Status: Fixed (ONNX 1.2.2+) Recommended Actions: - Immediately upgrade ONNX and related inference engines to the latest stable version - Validate inputs for existing models to ensure they conform to expected rank and shape - Enable ONNX Runtime's security mode (if available)

Goal Reached Thanks to every supporter — we hit 100%!

ONNX RNN/GRU/LSTM Out-of-Bounds Read (Missing Rank Check in Old Opsets) Analysis & POC

More from this source