Heap Overflow in NVIDIA TensorRT-LLM during ONNX Model Parsing
Overview
A high-severity heap-based buffer overflow vulnerability was identified in the NVIDIA TensorRT-LLM library. The flaw exists within the ONNX model parser component, specifically when handling models with malformed tensor shape definitions. An attacker could provide a specially crafted, malicious ONNX model file to an application that uses TensorRT-LLM for inference optimization. When the application attempts to load and parse this model, the library fails to correctly validate the size of certain metadata fields, leading to a write of arbitrary data past the boundary of an allocated buffer on the heap. This can be triggered remotely if the application allows users to upload or specify model files. The primary impact is a denial of service (DoS), as the memory corruption will cause the process to crash. However, skilled attackers could potentially exploit the overflow to achieve arbitrary code execution with the permissions of the user running the inference service. This vulnerability affects GPU-accelerated AI/ML workloads in data centers and cloud environments relying on TensorRT-LLM for optimizing large language model performance. The issue was responsibly disclosed by researchers from Google's Project Zero.
Affected Systems
Testing Guide
1. Check the currently installed version of the TensorRT-LLM library. On Linux, you may use a command like `pip list | grep tensorrt-llm` or check the build environment. 2. If the version is less than 0.11.1, the system is vulnerable. 3. Direct exploitation testing requires a specific proof-of-concept (PoC) model file, which is not publicly available. Rely on the version check for verification.
Mitigation Steps
1. Upgrade the NVIDIA TensorRT-LLM library to version 0.11.1 or later. 2. Ensure that any application which loads models from untrusted sources performs rigorous validation and scanning on the model files before passing them to the TensorRT-LLM library. 3. Run inference workloads with the minimum necessary privileges and within a containerized, resource-constrained environment to limit the potential impact of a successful code execution exploit.
Patch Details
The vulnerability is patched in NVIDIA TensorRT-LLM version 0.11.1. The patch adds stricter bounds checking during the parsing of ONNX model attributes.