Title

Arm NN native deserializer uses unknown layer union discriminator as parser-table index

Description

Arm NN commit 2b61cecc9df7a43fca1463795062cf359e6be820 contains an out-of-bounds dispatch-table read in the native .armnn deserializer.

The DeserializerImpl constructor creates m_ParserFunctions with Layer_MAX + 1 entries. CreateNetworkFromGraph() then indexes that vector directly with the model-controlled AnyLayer.layer_type() union discriminator:

auto& parserFunction = m_ParserFunctions[layer->layer_type()];
(this->*parserFunction)(graph, layerIndex);

The outer FlatBuffer verifier accepts unknown enum value 123. The generated Layer enum ends at Layer_MAX, so the lookup at src/armnnDeserializer/Deserializer.cpp:933 reads a member-function pointer beyond the heap allocation.

Reproduction

The public repository contains a deterministic one-byte differential:

control.armnn: byte 763 is 0x09 (InputLayer)
trigger.armnn: byte 763 is 0x7b (123, outside the generated enum)
every other byte is identical

Run:

./reproduce.sh /absolute/path/to/makemoney

Observed:

control: 3/3 exit 0
trigger: 3/3 exit 134

Representative sanitizer output:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8
#0 armnnDeserializer::IDeserializer::DeserializerImpl::CreateNetworkFromGraph(...)
SUMMARY: AddressSanitizer: heap-buffer-overflow in ...::CreateNetworkFromGraph(...)

SHA-256:

e1d1d9895e1629eaea453ac60cdc21cd38aef7bea9422aaefb41e23921cfd7ae  control.armnn
ff1c59432c9de9a631f1df9aab69d077d8b7a31e2e74b82aba4114da66f064bd  trigger.armnn

Impact

Loading an untrusted native Arm NN model causes a load-time out-of-bounds read from the parser member-function dispatch table and a reliable process crash. The out-of-bounds bytes are then interpreted as a member-function pointer for an indirect call. This report claims the demonstrated memory-safety violation and denial of service, not code execution.

Prior art

Authenticated and manual searches found no disclosure for AnyLayer.layer_type, m_ParserFunctions, CreateNetworkFromGraph, source line 933, the current fixture hash, or the sanitizer signature. Existing native Arm NN reports concern different semantic fields and sinks. The TFLite opcode_index finding uses a different input format, parser implementation, dispatch table, and remediation site.

Suggested remediation

Before the dispatch-table lookup, reject Layer_NONE, values greater than Layer_MAX, and any union discriminator not backed by the expected table type. The generated union verifier should also reject unknown discriminators.