krishprober/onnx-tensorrt-extdata-offset-oob-poc

onnx-tensorrt — OOB read via unvalidated external_data offset (CWE-125)

Loading malicious.onnx with onnx-tensorrt (NVIDIA's TensorRT ONNX parser; also bundled in NVIDIA/TensorRT) triggers an out-of-bounds read while importing the model's weights.

Root cause

onnx-tensorrt/WeightsContext.cpp, parseExternalWeights(): the offset from a TensorProto's external_data map is used directly as weightsPtr = mmap_base + offset with no bounds check against the mapped file size (only length is validated, against the tensor's dims). convertOnnxWeights() then reads the weights at mmap_base + offset (for DOUBLE tensors, via convertDouble() at parse time). offset is fully attacker-controlled (a decimal string parsed with atoll), so the read address is attacker-controlled.

Files

• poc.zip — contains malicious.onnx (the model) + w.bin; unzip before running. The ONNX model whose single initializer w uses external_data with offset=1073741824 (1 GiB), dtype=DOUBLE, dims=[8]
• w.bin — the (valid, 64-byte) external weights file it references
• harness.cpp / stubs.cpp / build.sh — a GPU-free ASAN harness that runs the real onnx-tensorrt weight-import path on malicious.onnx
• PROOF.txt — the AddressSanitizer report

Reproduce (GPU-free, ~minutes)

1. git clone https://github.com/onnx/onnx-tensorrt && git clone https://github.com/NVIDIA/TensorRT (for include/ headers)
2. Get protobuf without sudo: apt-get download protobuf-compiler libprotobuf-dev libprotobuf32t64 && for d in *.deb; do dpkg-deb -x "$d" localroot; done
3. Copy onnx-ml.proto (from the onnx pip package) into onnx/, then run build.sh.
4. unzip poc.zip && ./poc_oob malicious.onnx → AddressSanitizer: SEGV on ... READ in convertDouble at mmap_base + 0x40000000 (== the 1 GiB offset).

Alternatively, on a machine with TensorRT + a GPU: trtexec --onnx=malicious.onnx reaches the same import path.

Fix

In parseExternalWeights, validate offset (and offset + length) against the mapped file size before weightsPtr = mmap_base + offset; reject negative/out-of-range offsets.

Not a duplicate of the known ONNX external_data CVEs

This bug is in NVIDIA's onnx-tensorrt parser (WeightsContext.cpp), a different codebase from the onnx Python/C++ library. The publicly known ONNX external_data issues are path traversal:

• CVE-2022-25882 — onnx <1.13 external_data path outside model dir
• CVE-2026-27489 — onnx <1.21 external_data symlink escape

onnx-tensorrt already guards ../ path traversal. This report is a different bug class — an unvalidated numeric offset (not a path) added to the mmap base → out-of-bounds read. No CVE/GHSA/OSV or prior huntr report covers the onnx-tensorrt offset gap.

Severity

CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 6.5 (Medium) for the demonstrated crash/DoS; the attacker-controlled read address gives information-disclosure potential that could raise it.