You can deploy this model and start earning money today!

pragnyanramtha/
tensorrt-onnx-symlink-lfr-poc

Name: tensorrt-onnx-symlink-lfr-poc
Availability: InStock

Views

No views yet

TensorRT ONNX External Data Symlink Traversal PoC

This is a benign security PoC. It demonstrates that TensorRT 10.16.1.11 follows a symlink used as an ONNX external_data.location file, while ONNX 1.21 rejects the same symlink before loading external data.

Files

model_dir/model.onnx: ONNX model with initializer W stored in external data.
model_dir/weights_link.bin: symlink to the controlled marker file outside model_dir.
controlled_sensitive_marker.bin: safe marker file outside model_dir.
verify_poc.py: rebuilds the lab and runs validation/inference.
results.json: captured local output.

Trigger

The model sets external_data.location to weights_link.bin. That file is inside the model directory but is a symlink to a file outside the model directory.

Reproduction

bash

pip install tensorrt-cu13 onnx numpy modelscan cuda-python
python verify_poc.py --from-staging

Expected result:

ONNX checker/load rejects weights_link.bin because it is a symlink.
ModelScan 0.8.8 skips .onnx as unsupported.
TensorRT parses and builds the ONNX model.
TensorRT inference outputs [1234.5, 2345.5, 3456.5, 4567.5], proving the external data target outside model_dir was consumed as model weights.

Security Impact

An application that accepts untrusted ONNX models for TensorRT compilation can be induced to read external tensor bytes through a symlink that escapes the model directory. If the attacker can control the symlink target and observe inference outputs, this becomes a controlled local-file-read primitive. This PoC reads only a synthetic marker file.

Versions

TensorRT: 10.16.1.11
ONNX: 1.21.0
Python: 3.12.12

SHA256

model_dir/model.onnx: 05340543e4e7216db0bb4c10b3ac6701777931e6def0df3a7a68e995402af640
controlled_sensitive_marker.bin: d486a60053f484720bd63ca722d0504219f110e77ca974e10b9432d76567a0ad

Mitigation

Before TensorRT parses ONNX external data, reject symlinks and require the resolved real path of each external data file to remain inside the intended model directory.

pragnyanramtha/tensorrt-onnx-symlink-lfr-poc