GHSA-m4pr-6v3c-6fgr: Null Pointer Dereference
Summary
ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process:
1. If the attribute was missing, ctx.getAttribute("numscaninputs") returned null and was dereferenced. 2. If the attribute was negative, conversion to sizet produced a very large value that reached a vector allocation and raised std::lengtherror.
The negative-value variant passed onnx.checker.checkmodel() before reaching shape inference.
Technical details
The vulnerable Scan inference implementations used the following pattern:
cpp auto numscaninputs = narrowcast<sizet>(ctx.getAttribute("numscaninputs")->i());
This code neither checked the returned pointer nor rejected a negative signed value before converting it to an unsigned size. The pattern was present in the current Scan inference function and the older opset 8 and 9 paths.
The fix uses the required-attribute helper and checked narrowing:
cpp auto numscaninputs = narrow<sizet>(getRequiredAttributeInt(ctx, "numscaninputs"));
Impact
An application that performs shape inference on an untrusted model can be terminated or forced into an exceptional allocation path, causing denial of service. No confidentiality or integrity impact was demonstrated.
Affected versions
- Affected: ONNX 1.4.0 through 1.21.0 - Patched: ONNX 1.22.0
ONNX 1.4.0 is the first release containing the vulnerable Scan shape-inference implementation.
Remediation
Upgrade to ONNX 1.22.0 or later.
- Fix: onnx/onnx#7916 - Commit: dd6bc92ea
Both reported models were re-tested against the published ONNX 1.23.2 wheel and correctly raise InferenceError.
Severity
The vulnerable ONNX component processes the malicious model through a local library API or file boundary and is not itself bound to a network stack. Applications that expose ONNX model processing over a network should calculate an Environmental score with Modified Attack Vector set to Network.
The two triggers remain in one advisory because they affect the same required attribute, share the same unsafe conversion path and remediation, and were fixed in the same release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/onnxto a version that resolves this vulnerability.Fixed in 1.22.0 - Upgrade
Upgrade
ONNXto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
Which deployments are exposed to denial of service?
Applications that run ONNX shape inference on untrusted models are exposed. A malformed Scan operator can terminate or disrupt the process performing inference.
What must an attacker provide to trigger the issue?
The attacker needs to supply a model processed by shape inference that contains a Scan node with either a missing num_scan_inputs attribute or a negative value for that attribute. No privileges or user interaction are indicated by the provided severity vector.
Can model validation detect the malformed input?
Not reliably. The negative num_scan_inputs variant passes onnx.checker.check_model() before it reaches shape inference.
Which Scan inference paths should be reviewed?
The affected pattern was present in the current Scan inference implementation and in the older opset 8 and opset 9 paths. Review environments that may process models using any of those paths.