ONNX External Data Loading Symlink Traversal Vulnerability
Overview
The Open Neural Network Exchange (ONNX) format, a standard for machine learning model interoperability, is susceptible to a symlink traversal vulnerability in its external data loading mechanism. Versions prior to 1.21.0 fail to properly sanitize paths when loading external data associated with an ONNX model. An attacker can craft a malicious ONNX model that includes symbolic links (symlinks) pointing to files outside the intended model directory. When this model is loaded and processed by a vulnerable ONNX runtime, the external data loading function will follow these symlinks, potentially granting unauthorized read access to sensitive files on the host system. This could include configuration files, credentials, or other sensitive data, leading to information disclosure and further system compromise. The vulnerability arises from insufficient validation of the resolved path after symlink resolution, allowing the process to access arbitrary files accessible by the user running the ONNX runtime.
Affected Systems
Testing Guide
1. Craft a malicious ONNX model containing a symlink that points to a sensitive file outside the model's directory (e.g., `/etc/passwd`). 2. Ensure the ONNX runtime environment is running with appropriate user privileges. 3. Attempt to load and process the crafted ONNX model using a vulnerable version of ONNX Runtime. 4. Monitor for any successful reads or access attempts to the targeted sensitive file. If the file content is exposed or an error indicates file access outside the expected scope, the system is affected.
Mitigation Steps
* Update ONNX Runtime to version 1.21.0 or later. * Implement strict input validation and sanitization for model file paths before loading. * Limit the permissions of the user account running the ONNX runtime to the minimum necessary. * Consider using a sandboxing environment for loading and processing untrusted ONNX models. * Regularly audit file access logs for unusual patterns related to model loading.
Patch Details
Version 1.21.0