| Title | Sonos (sonos/tract) tract main @ 2b68fb8 (release line 0.21.x) Denial of Service |
|---|
| Description | tract-onnx constructs a tensor for an ONNX initializer by allocating product(dims) * sizeof(dtype) bytes
and then copying the protobuf raw_data field into that buffer with copy_from_slice, without first checking
that the raw_data byte length matches the length implied by the declared shape and dtype. The copy occurs
in Tensor::from_raw_dt_align at data/src/tensor.rs line 502, reached from the ONNX initializer loader
(onnx/src/tensor.rs, create_tensor). A crafted .onnx model whose raw_data byte count differs from its
declared shape causes a copy_from_slice length-mismatch panic during model_for_path(), including in
release builds.
Impact: denial of service (process panic) when loading a crafted .onnx model. CWE-131 (incorrect
calculation of buffer size) leading to an uncaught panic. Proposed CVSS 6.5
(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Attack vector: an attacker supplies a malicious .onnx file which, when loaded, panics the process. No
length check exists on this path. Re-verified live on current main (2b68fb8) on 2026-06-27 by
rebuild-and-replay: panics at data/src/tensor.rs:502. Reported via public issue #2390. Distinct from the
shape-inference operand-index panics tracked in issue #2391, and from the (already-fixed) read_tensor
overflow in issue #2371. |
|---|
| Source | ⚠️ https://github.com/sonos/tract/issues/2390 |
|---|
| User | m00dy (UID 97162) |
|---|
| Submission | 07/01/2026 22:38 (2 months ago) |
|---|
| Moderation | 08/17/2026 18:39 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 391335 [sonos tract up to 0.23.4 ONNX Initializer Loader data/src/tensor.rs from_raw_dt_align buffer size] |
|---|
| Points | 20 |
|---|