Views
No views yet
offset (CWE-125)malicious.onnx with onnx-tensorrt (NVIDIA's TensorRT ONNX parser; also bundled in NVIDIA/TensorRT)
triggers an out-of-bounds read while importing the model's weights.onnx-tensorrt/WeightsContext.cpp, parseExternalWeights(): the offset from a TensorProto's
external_data map is used directly as weightsPtr = mmap_base + offset with no bounds check against the
mapped file size (only length is validated, against the tensor's dims). convertOnnxWeights() then reads
the weights at mmap_base + offset (for DOUBLE tensors, via convertDouble() at parse time).
offset is fully attacker-controlled (a decimal string parsed with atoll), so the read address is attacker-controlled.poc.zip — contains malicious.onnx (the model) + w.bin; unzip before running. The ONNX model whose single initializer w uses external_data with offset=1073741824 (1 GiB), dtype=DOUBLE, dims=[8]w.bin — the (valid, 64-byte) external weights file it referencesharness.cpp / stubs.cpp / build.sh — a GPU-free ASAN harness that runs the real onnx-tensorrt weight-import path on malicious.onnxPROOF.txt — the AddressSanitizer reportgit clone https://github.com/onnx/onnx-tensorrt && git clone https://github.com/NVIDIA/TensorRT (for include/ headers)apt-get download protobuf-compiler libprotobuf-dev libprotobuf32t64 && for d in *.deb; do dpkg-deb -x "$d" localroot; doneonnx-ml.proto (from the onnx pip package) into onnx/, then run build.sh.unzip poc.zip && ./poc_oob malicious.onnx → AddressSanitizer: SEGV on ... READ in convertDouble at mmap_base + 0x40000000 (== the 1 GiB offset).trtexec --onnx=malicious.onnx reaches the same import path.parseExternalWeights, validate offset (and offset + length) against the mapped file size before
weightsPtr = mmap_base + offset; reject negative/out-of-range offsets.onnx-tensorrt parser (WeightsContext.cpp), a different codebase from the onnx
Python/C++ library. The publicly known ONNX external_data issues are path traversal:<1.13 external_data path outside model dir<1.21 external_data symlink escapeonnx-tensorrt already guards ../ path traversal. This report is a different bug class — an unvalidated
numeric offset (not a path) added to the mmap base → out-of-bounds read. No CVE/GHSA/OSV or prior huntr
report covers the onnx-tensorrt offset gap.AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 6.5 (Medium) for the demonstrated crash/DoS; the attacker-controlled
read address gives information-disclosure potential that could raise it.