Описание
tract: Arbitrary file read via unsanitized ONNX external_data location (path traversal) on model load in tract-onnx
Summary
tract (the tract-onnx crate) resolves an ONNX tensor's external-data location by joining it onto the model directory without any sanitization. Because location comes from the (untrusted) .onnx file, a malicious model can make tract open and read an arbitrary local file at load time, with the file's contents flowing into the model's tensors / inference output (read-only file disclosure). This is the ONNX external-data path-traversal class that the reference onnx library hardened over several CVEs; tract resolves location itself and was never hardened.
Details
In onnx/src/tensor.rs, get_external_resources() builds the path with no checks:
Path::joinwith an absolutelocation(e.g./etc/passwd) discards the base directory →p = /etc/passwd.- A relative
../../../../etc/passwdvalue is not normalized → directory traversal. - The default
MmapDataResolver(onnx/src/data_resolver.rs) thenmmaps the file and copiesmmap[offset..offset+length]into the tensor.offset/lengthare also taken from the file; an out-of-range slice panics (DoS).
No is_absolute, .., canonicalize, or containment check exists anywhere on this path (tensor.rs, model.rs, data_resolver.rs).
Reachable from the standard public API: model_for_path(p) (onnx/src/model.rs) sets model_dir = p.parent() and calls load_tensor(proto, model_dir) → get_external_resources(.., model_dir).
PoC
Tested on tract-onnx 0.21.16 (crates.io), Rust 1.96.
- A canary file the model must not be able to read:
/tmp/tract_canary_secret.txt→TRACT-EXTDATA-TRAVERSAL-CANARY-7f3a2b - Build a small
evil.onnxwith aUINT8[37]initializer whoseexternal_dataislocation=/tmp/tract_canary_secret.txt(absolute),offset=0,length=37, fed throughIdentityto the output (raw protobuf serialization):
- Victim loads the untrusted model with the standard API:
Output:
i.e. the contents of the arbitrary local file were read by tract and surfaced in the inference output.
Impact
Read-only arbitrary local file disclosure when an application uses tract to load an untrusted or shared ONNX model (model hubs, multi-file repos, user uploads). The file content is recoverable from the model's tensors / inference output. Secondary: denial of service (panic) via out-of-bounds offset/length. No write or code execution.
Suggested fix
Reject absolute location and any .. component, then canonicalize and verify the resolved path stays within the model directory (mirroring onnx 1.22.0's resolve_external_data_location); reject symlinks; validate offset/length against the file size before slicing.
Пакеты
tract-onnx
< 0.21.17
0.21.17
tract-onnx
>= 0.22.0, < 0.22.3
0.22.3
tract-onnx
>= 0.23.0, < 0.23.2
0.23.2
Связанные уязвимости
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.