pragnyanramtha/opencv-darknet-yolo-mask-oob-poc

OpenCV DNN Darknet YOLO mask OOB Read / SIGSEGV PoC

This repository contains benign Darknet .cfg model artifacts that demonstrate an OpenCV DNN Darknet importer memory-safety issue. The PoC does not execute code, persist state, access credentials, or make network calls; it only demonstrates a native crash / OOB-read condition in a local model loader.

Summary

yolo_mask_large.cfg defines a Darknet YOLO layer with num=1, anchors=10,13, and model-controlled mask=999999. When OpenCV DNN imports the model, the Darknet importer uses the mask value as an unchecked index into the anchor array. The current tested wheel, opencv-python-headless==4.13.0.92, exits with SIGSEGV when loading the artifact through both explicit Darknet APIs and generic cv2.dnn.readNet(...) paths.

Local ASAN evidence maps the bug to OpenCV modules/dnn/src/darknet/darknet_io.cpp:537, where anchors[mask[i] * 2] is read without validating the model-controlled mask value against the number of anchors.

Affected Format

• Format: Darknet model config (.cfg) with companion weights header
• Tested target: opencv-python-headless==4.13.0.92
• Trigger paths:
  • cv2.dnn.readNetFromDarknet(cfg)
  • cv2.dnn.readNetFromDarknet(cfg, weights)
  • cv2.dnn.readNet(cfg)
  • cv2.dnn.readNet(cfg, weights)
• Impact class: native OOB read / process DoS during model import

Artifacts

• artifacts/yolo_mask_large.cfg
  • SHA256: 38250cc2b319c03f47355c3e370a514870ca156b30d98e5e4834e4018e5c50c4
  • Primary SIGSEGV artifact
• artifacts/header_only.weights
  • SHA256: 2d42634a033bb4952d353d7e9b896478a7e1f2553888199f8df89e42ca2c281b
  • Minimal Darknet weights header used for API paths that expect a weights file
• artifacts/yolo_mask_one_past_forwardable.cfg
  • SHA256: c30e36bc46237a48a95c575eab43ce0e6e8b2c81079bc612bd59deac803a99ae
  • Supporting variant that loads and completes net.forward() in the release wheel; ASAN reports heap-buffer-overflow
• artifacts/yolo_mask_negative_forwardable.cfg
  • SHA256: 7ec94937c5f7586830cbc6ca8ee7483427e22b743cb29c3ef0d1bda244df1cab
  • Supporting variant that loads and completes net.forward() in the release wheel; ASAN reports heap-buffer-overflow

Reproduction

Install OpenCV, then run:

python verify_darknet_yolo_mask_oob.py

Expected high-level result:

• yolo_mask_large.cfg returns SIGSEGV (-11 through Python subprocess, shell status 139) across the importer paths.
• The two forwardable YOLO-mask variants return 0 for net.forward() and print forward_shape=(1, 6).

Manual minimal reproduction:

python - <<'PY'
import cv2
cv2.dnn.readNetFromDarknet("artifacts/yolo_mask_large.cfg", "artifacts/header_only.weights")
PY

Scanner Behavior

ModelScan 0.8.8 reports zero issues and scans zero files for these Darknet artifacts. ModelAudit 0.2.45 classifies yolo_mask_large.cfg as unknown with no checks.

This is not presented as a scanner bypass by itself because Darknet is unsupported. The security impact comes from a current real loader reaching native memory-unsafe code from model-controlled fields.

Evidence

The evidence/ directory contains captured local outputs, ASAN line mapping, and scanner output.

Limitation

This is a native OOB read / process crash in a model importer, not arbitrary code execution.