| # TensorRT ONNX External Data Offset Crash PoC | |
| ## Vulnerability | |
| A crafted ONNX model with an `external_data` weight reference containing a negative | |
| offset value (`-1`) crashes TensorRT's engine builder with `STATUS_ACCESS_VIOLATION` | |
| (0xC0000005 on Windows / SIGSEGV on Linux). | |
| - **Model size**: 185 bytes (+ 64-byte weight file = 249 bytes total) | |
| - **Crash rate**: 100% (10/10 runs) | |
| - **Affected phase**: `build_serialized_network()` (parse succeeds with no error) | |
| - **Tested on**: TensorRT 10.15.1.29, Windows, CUDA 12.x | |
| ## Root Cause | |
| The ONNX `external_data` offset field is `int64` in the protobuf spec. TensorRT's | |
| `WeightsContext.cpp::parseExternalWeights()` does not validate the offset before | |
| passing it to `seekg()`. Negative values cause undefined behavior in file I/O, | |
| producing garbage weight data that crashes the builder during optimization. | |
| **All negative offsets crash. All offsets >= ~2^32 also crash.** | |
| ## Files | |
| | File | Description | | |
| |------|-------------| | |
| | `crash_offset_neg1.onnx` | Malicious ONNX model (offset=-1) - **CAUSES CRASH** | | |
| | `benign_offset_0.onnx` | Benign ONNX model (offset=0) - builds normally | | |
| | `weights.bin` | Weight file (64 bytes, required by both models) | | |
| | `reproduce.py` | Reproduction script | | |
| ## Reproduction | |
| ```bash | |
| pip install tensorrt onnx numpy torch | |
| python reproduce.py | |
| ``` | |
| ### Expected output: | |
| ``` | |
| [1] Benign model (offset=0): | |
| benign: rc=0 BUILD_OK size=... | |
| [2] Malicious model (offset=-1): | |
| malicious: CRASH (STATUS_ACCESS_VIOLATION 0xC0000005) | |
| [3] Reproducibility (5 runs): | |
| run 1: CRASH (STATUS_ACCESS_VIOLATION 0xC0000005) | |
| run 2: CRASH (STATUS_ACCESS_VIOLATION 0xC0000005) | |
| ... | |
| Crash rate: 5/5 | |
| ``` | |
| ## Impact | |
| Any TensorRT pipeline that accepts untrusted ONNX models and compiles them will crash: | |
| - NVIDIA Triton Inference Server | |
| - TensorRT-LLM ONNX compilation | |
| - MLOps platforms accepting user-submitted models | |
| - CI/CD pipelines compiling ONNX models | |
| ## Severity | |
| High (CVSS 3.1: 7.5 -- AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) | |
| Potential for memory corruption escalation beyond DoS. | |