| タイトル | Tencent ncnn master 3b7bdba Out-of-Bounds Read |
|---|
| 説明 | Out-of-bounds read in Tencent ncnn (src/layer/matmul.cpp and src/layer/x86/gemm_x86_avx.cpp).
MatMul::forward hands both runtime inputs to an internal Gemm sublayer and derives the K dimension strictly from the first input A (const int K = A.w), with no cross-input consistency check against the second input B's width. A model declaring A.w greater than B.w makes the gemm B-matrix packer (transpose_pack_B_tile) read B's columns according to K=A.w, past the B allocation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H (Base 7.1, High)
Confirmed via ASAN on x86_64 Linux (gcc 15.2):
==43122==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x73d9923e0280
READ of size 16 at 0x73d9923e0280 thread T0
#0 _mm_loadu_ps (xmmintrin.h:982)
#1 transpose_pack_B_tile (gemm_x86_avx.cpp:1958)
#2 ncnn::gemm_x86 (gemm_x86_avx.cpp:3029)
#5 ncnn::Gemm_x86_avx::forward (gemm_x86_avx.cpp:3896)
#6 ncnn::MatMul_x86_avx::forward (matmul_x86_avx.cpp:178)
Verified: baseline model with A.w equal to B.w (8x8) runs clean (extract ret=0); the A.w=8, B.w=4 model crashes deterministically.
Triggered by loading an attacker-controlled model file through the normal load_param + load_model + extract flow; no authentication or special configuration required. Consequences: deterministic crash (denial of service) plus a limited out-of-bounds read that may leak adjacent heap data when the read lands in a mapped region. No write primitive; no RCE developed.
No upstream fix as of 2026-10-01. The layer-param hardening PR #7003 does not cover matmul.cpp, so the dynamic two-input case is unaffected by it.
|
|---|
| ソース | ⚠️ https://github.com/Tencent/ncnn/issues/7034 |
|---|
| ユーザー | JerryGW (UID 99144) |
|---|
| 送信 | 2026年10月01日 11:31 (18 日 ago) |
|---|
| モデレーション | 2026年10月18日 15:41 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421752 [Tencent ncnn 迄 44b02dabdcf97499281a4692ebd65bad73dcf8b6 MatMul src/layer/matmul.cpp matmul_transb 情報漏えい] |
|---|
| ポイント | 20 |
|---|