Executive brief
A vulnerability in the onnx-mlir compiler infrastructure can cause machine learning models to produce incorrect results without warning. When processing different models that share the same structure but use different data types (such as 32-bit vs 64-bit floats), the system may mistakenly reuse a previously compiled version of a different model. This "cache collision" leads to silent data corruption or incorrect inference results, which could impact the reliability of AI-driven decision-making processes.
Technical details
A vulnerability exists in the `generate_hash_key` function within `src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py` of onnx-mlir. When `use_lightweight_hashing` is enabled (the default), the hashing logic for placeholder nodes only incorporates the tensor shape and ignores the data type (dtype). This root cause allows two distinct models with identical shapes but different dtypes (e.g., float32 vs float64) to generate the same cache key. Consequently, the runtime may incorrectly load and execute a previously compiled shared object (.so) file from a different model. An attacker with local access could potentially exploit this to cause integrity failures or denial of service through incorrect computational outputs. The issue is addressed in commit 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4 by appending the dtype to the placeholder identifier string.
Affected products
- onnx onnx-mlir up to 0.5.0.0
Timeline
- 2026-03-25: other: Pull request submitted to fix the issue
- 2026-03-30: patched: Fix merged into main branch
- 2026-06-05: disclosed: CVE published