ONNX Path Traversal Vulnerability via Hardlinks in onnx.load
Overview
The `onnx.load` function in the Open Neural Network Exchange (ONNX) library, prior to version 1.21.0, contains a path traversal vulnerability. The library attempts to prevent malicious code execution by checking for symbolic links (symlinks) during file loading, which could be used to point to unintended locations on the filesystem. However, this protection mechanism is incomplete as it fails to detect hardlinks. A hardlink, unlike a symlink, appears as a regular file to the operating system and the `onnx.load` function's checks. An attacker could create a hardlink pointing to sensitive system files or configuration files outside the intended model directory. When `onnx.load` processes this hardlinked file, it would inadvertently read and potentially process data from the target of the hardlink, leading to information disclosure or, in certain contexts, unintended code execution if the loaded data is later interpreted by other system components. This bypasses the intended security controls designed to sandbox model loading.
Affected Systems
Testing Guide
1. Create a dummy sensitive file (e.g., `/tmp/sensitive_data.txt`) with some content. 2. Create an ONNX model file in a separate directory. 3. Create a hardlink from the ONNX model directory to the sensitive file (e.g., `ln /tmp/sensitive_data.txt ./malicious_model.onnx`). 4. Attempt to load the `malicious_model.onnx` file using `onnx.load()`. 5. Verify if the content of `/tmp/sensitive_data.txt` is read or processed by the application using ONNX. If it is, the system is vulnerable.
Mitigation Steps
- Upgrade the ONNX library to version 1.21.0 or later. - Implement strict file system access controls on directories where ONNX models are stored. - Sanitize user-provided file paths before passing them to `onnx.load`. - If upgrading is not immediately possible, avoid loading ONNX models from untrusted sources that could contain hardlinks to sensitive files.
Patch Details
1.21.0