tensorrt-onnx-symlink-lfr-poc

TensorRT ONNX External Data Symlink Traversal PoC

This is a benign security PoC. It demonstrates that TensorRT 10.16.1.11 follows a symlink used as an ONNX external_data.location file, while ONNX 1.21 rejects the same symlink before loading external data.

Files

• model_dir/model.onnx: ONNX model with initializer W stored in external data.
• model_dir/weights_link.bin: symlink to the controlled marker file outside model_dir.
• controlled_sensitive_marker.bin: safe marker file outside model_dir.
• verify_poc.py: rebuilds the lab and runs validation/inference.
• results.json: captured local output.

Trigger

The model sets external_data.location to weights_link.bin. That file is inside the model directory but is a symlink to a file outside the model directory.

Reproduction

pip install tensorrt-cu13 onnx numpy modelscan cuda-python
python verify_poc.py --from-staging

Expected result:

• ONNX checker/load rejects weights_link.bin because it is a symlink.
• ModelScan 0.8.8 skips .onnx as unsupported.
• TensorRT parses and builds the ONNX model.
• TensorRT inference outputs [1234.5, 2345.5, 3456.5, 4567.5], proving the external data target outside model_dir was consumed as model weights.

Security Impact

An application that accepts untrusted ONNX models for TensorRT compilation can be induced to read external tensor bytes through a symlink that escapes the model directory. If the attacker can control the symlink target and observe inference outputs, this becomes a controlled local-file-read primitive. This PoC reads only a synthetic marker file.

Versions

• TensorRT: 10.16.1.11
• ONNX: 1.21.0
• Python: 3.12.12

SHA256

• model_dir/model.onnx: 05340543e4e7216db0bb4c10b3ac6701777931e6def0df3a7a68e995402af640
• controlled_sensitive_marker.bin: d486a60053f484720bd63ca722d0504219f110e77ca974e10b9432d76567a0ad

Mitigation

Before TensorRT parses ONNX external data, reject symlinks and require the resolved real path of each external data file to remain inside the intended model directory.