You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

PoC — TensorRT plugin-deserialization out-of-bounds read (huntr MFV)

Gated security PoC. Access restricted to huntr/ProtectAI triage (protectai-bot).

Loading an attacker-supplied serialized TensorRT engine triggers a heap out-of-bounds read during plugin deserialization. TensorRT's legacy plugins deserialize with a read<T>() helper (plugin/common/plugin.h:100) that memcpys and advances a cursor with no remaining-length tracking; a file-controlled count (regionPlugin.cpp:117 smTreeTemp->n) then drives a read loop (:152) that walks past the serialized-data buffer.

Reached via the public API IRuntime::deserializeCudaEngine(blob, size) → RegionPluginCreator::deserializePlugin → new Region(serialData, serialLength).

Files

evil_region_plugin.bin — the attacker-controlled serialized-plugin payload (the serialData bytes embedded in a crafted .engine).
make_evil_blob.py — generates the payload; documents the exact byte layout.
asan_repro.cpp — faithful repro of the exact sink (verbatim read<T> + Region deserialize ctor read-loop).
evidence.txt — full AddressSanitizer transcript.

Reproduce

python3 make_evil_blob.py
g++ -std=c++17 -fsanitize=address -g asan_repro.cpp -o asan_repro
./asan_repro evil_region_plugin.bin      # -> AddressSanitizer: heap-buffer-overflow, READ of size 4

CWE-125 (Out-of-bounds Read); CWE-190 / CWE-787 for the DoS and 32-bit overflow-write variants. Fix: bound every count against the remaining serialized-data length before allocating/reading (as plugin/common/serialize.hpp already does).

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support