ONNX ExternalDataInfo Vulnerability Allows Model Property Overwriting
Overview
The ONNX (Open Neural Network Exchange) format is designed for interoperability between machine learning frameworks. In versions prior to 1.21.0, the ExternalDataInfo class within the ONNX library had a critical vulnerability related to how it processed metadata from ONNX model files. Specifically, it utilized Python's `setattr()` function to directly load metadata, such as file paths and data lengths, without performing adequate validation on the 'keys' provided in the model file. This lack of validation allowed an attacker to craft a malicious ONNX model file. When this crafted model is loaded and processed by a vulnerable ONNX library, the attacker can exploit the `setattr()` function to overwrite internal object properties of the ExternalDataInfo class. This could lead to unexpected behavior, potential denial-of-service, or even enable further security compromises by manipulating the state or behavior of the ONNX runtime or downstream applications that rely on accurate model metadata. The vulnerability stems from insufficient sanitization of external input used in a privileged function.
Affected Systems
Testing Guide
1. Obtain or craft a malicious ONNX model file designed to exploit the `setattr()` vulnerability in ExternalDataInfo. 2. Attempt to load this malicious model using a vulnerable version of the ONNX library (prior to 1.21.0) within a controlled environment. 3. Observe the behavior of the ONNX runtime or the application attempting to load the model. Look for errors, unexpected exceptions, or deviations from expected metadata processing. 4. If the model loads without errors and the application's state is altered in an unexpected way, the system may be affected.
Mitigation Steps
- Ensure all ONNX models are sourced from trusted repositories or validated before use. - Upgrade the ONNX library to version 1.21.0 or later. - Implement input validation for model metadata if upgrading is not immediately feasible (complex). - Conduct security audits on model loading pipelines. - Monitor application behavior for unexpected changes after loading new models.
Patch Details
1.21.0