Denial of Service in Keras via Malicious .keras Model

Executive Summary

This vulnerability is a denial of service (DoS) flaw in Keras versions up to 3.15.0. It occurs when loading malicious .keras model files using keras.models.load_model(). The issue is in the H5IOStore.__getitem__ method which fails to validate dataset shapes or sizes, allowing unbounded memory allocation. A crafted .keras file can trigger an out-of-memory (OOM) condition, crashing the process with exit code 137. The attack can come from poisoned models in public repositories or malicious registries, threatening machine learning pipelines that handle untrusted models.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for out-of-memory (OOM) errors when loading .keras model files. Check system logs for processes terminated with exit code 137. Inspect model files for unusually large declared shapes in HDF5 datasets using tools like h5ls or h5py in Python. Example command: h5ls -r malicious_model.keras to view dataset shapes.

Useful 0 Not Useful 0

Impact Analysis

If you use Keras versions <= 3.15.0, an attacker could exploit this to crash your application by loading a malicious model file. This could disrupt services relying on Keras models, cause data loss, or require restarting processes. It poses risks to machine learning pipelines processing untrusted models, especially in automated or batch processing environments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks on systems processing untrusted .keras model files. An OOM condition may disrupt services handling sensitive data, potentially violating availability requirements under GDPR Article 32 and HIPAA Security Rule standards for safeguarding protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Keras to version 3.15.0 or later. Avoid loading untrusted .keras model files. Implement input validation for model files in your pipeline. Use the safe_get_h5_dataset guard to reject datasets with disproportionate declared sizes. Monitor for OOM conditions during model loading.

Useful 0 Not Useful 0