NVIDIA TensorRT Out-of-Bounds Write Vulnerability When Parsing Malicious ONNX Models
Overview
NVIDIA released a security update for its TensorRT SDK, which is used for high-performance deep learning inference. The update addresses a critical vulnerability (CVE-2025-34992) related to parsing ONNX (Open Neural Network Exchange) model files. A specially crafted ONNX file with malformed layer attributes could trigger an out-of-bounds write during the model optimization phase. When TensorRT attempts to parse and build an optimized engine from the malicious model, it miscalculates a buffer size based on the corrupted attributes, leading to a heap-based buffer overflow. An attacker could exploit this vulnerability to achieve denial-of-service (DoS) by crashing the TensorRT application. More critically, on certain platforms and configurations, this memory corruption could be further exploited to achieve arbitrary code execution with the permissions of the user running the TensorRT process. This poses a significant risk to systems that automatically ingest and optimize models from untrusted sources, such as cloud-based AI model serving platforms or security research environments analyzing potentially malicious AI artifacts. The vulnerability affects a wide range of applications built with TensorRT for GPU-accelerated inference.
Affected Systems
Testing Guide
1. **Check Version:** Determine the version of the TensorRT library being used in your environment by checking the library files (e.g., `libnvinfer.so`) or using the API's version query function. 2. **Use a PoC:** If you have access to a proof-of-concept (PoC) malicious ONNX file, attempt to build an engine from it using your version of TensorRT in a controlled, isolated environment. If the process crashes due to a segmentation fault, you are likely vulnerable.
Mitigation Steps
1. **Update TensorRT:** Upgrade to a patched version of the NVIDIA TensorRT SDK (8.6.4, 9.2.1, or newer). 2. **Scan Untrusted Models:** Before parsing any model file from an external or untrusted source, use a model scanning tool or perform validation checks on the ONNX graph structure. 3. **Run in a Container:** Execute TensorRT processes within a containerized, low-privilege environment to limit the impact of a potential code execution exploit. 4. **Address Space Layout Randomization (ASLR):** Ensure standard OS-level security protections like ASLR are enabled to make exploitation more difficult.
Patch Details
Patches are available in TensorRT versions 8.6.4 and 9.2.1 and all subsequent releases. See the NVIDIA security bulletin for details.