[GSD-14017] YAML parser: unchecked node indices in buildTree cause OOB access

未关闭
  • 哪里不对？
#1,043 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
cpp
领域
security

调研方向

Start with NEO::Yaml::buildTree in shared/source/device_binary_format/yaml/yaml_parser.cpp (around line 360) and the YamlParser class in yaml_parser.h, tracing where invalidNodeID is compared against the NodesCache indices. Then check how level_zero/core/source/module/modules_package_binary.cpp passes untrusted YAML into the parser. Done means that every node index is bounds-checked before use and a crafted-input test no longer crashes; the report's three claims should be reproduced before fixing.

由索引模型根据 Issue 内容生成。

描述

Problem

NEO::Yaml::buildTree (shared/source/device_binary_format/yaml/yaml_parser.cpp, line 360) and the YamlParser class (yaml_parser.h) use NodeId indices to navigate a NodesCache (vector of Node). Multiple paths use invalidNodeID (std::numeric_limits<NodeId>::max()) as a sentinel, but the value is also used as an array index before being checked.

Three bugs from the same root cause:

1. DEADLYSIGNAL (crash) at yaml_parser.h:502

buildTree is called with crafted token data. A node index that should be invalidNodeID is instead used to access nodes[], reading past the vector bounds. Process crashes with SIGSEGV.

2. Container out-of-bounds

A crafted input produces a nodeOrdinal or childId that exceeds outNodes.size(). The nodes[childId] access at lines like 504 reads past the vector.

3. Stack buffer overflow at yaml_parser.h:502

Token scanning does not check for NUL termination in all paths. A crafted input causes buildTree to write past a stack-allocated buffer during token processing.

All three are triggered through ModulesPackageBinary::decode (level_zero/core/source/module/modules_package_binary.cpp) which feeds untrusted module binary data into the YAML parser.

Impact

Crash (denial of service). Reachable through zeModuleCreate (Level Zero) when the module binary contains a YAML manifest section. A crafted program binary triggers OOB access in the YAML parser during module loading.

Suggested fix

  1. Validate all NodeId values against outNodes.size() before using them as indices.
  2. Add NUL-termination checks in token scanning paths.
  3. Validate buildTree output node count against input token count as a sanity bound.

Found by BrightSec automated security scanning.

主要语言
C++
星标
1.5k
派生
306
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

intel/compute-runtime 的其他 Issue

查看 intel/compute-runtime 的全部 Issue

相似的 Issue

更多 C++ Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。