treforbenbow/tensorrt-onnx-recursive-function-crash

VULN-010: Uncontrolled Recursion in TensorRT ONNX Parser via Recursive FunctionProto

Summary

A 110-byte ONNX model with a self-referencing FunctionProto definition crashes TensorRT ONNX parser (nvonnxparser) with stack overflow (STATUS_STACK_OVERFLOW / 0xC00000FD) during parse(). The parser performs unbounded recursion when expanding the function body, which references itself, exhausting the call stack.

• CWE: CWE-674 (Uncontrolled Recursion)
• Severity: High (CVSS 7.5)
• Affected: TensorRT 10.15.1.29 (and likely all TRT 10.x with ONNX parser)
• Reproducibility: 100% (10/10)

Vulnerability Details

ONNX IR v8+ supports FunctionProto, which are inline function definitions within a model. TensorRT ONNX parser processes these via the LocalFunctionImporter in onnxOpCheckers.cpp. During the static checking phase (parseNodeStaticCheck), when the parser encounters a node that references a local function, it recursively processes that function body nodes.

The model import path (ModelImporter.cpp) has a recursion depth limit (kMAX_NESTED_SUBGRAPHS = 24), but the static checking phase runs first and has no recursion depth limit. A self-referencing FunctionProto causes infinite recursion in the static check path, exhausting the call stack before the depth-limited import phase is reached.

The model passes onnx.checker.check_model() and is structurally valid ONNX.

Files

• vuln010_self_recursive.onnx (110 bytes) - Self-recursive function (R calls R)
• vuln010_mutual_recursive.onnx (152 bytes) - Mutually recursive (A calls B, B calls A)
• vuln010_standalone_poc.py - Build/crash/verify script

Reproduction

python vuln010_standalone_poc.py build # Build PoC models python vuln010_standalone_poc.py verify # Runs 5 trials per variant python vuln010_standalone_poc.py crash # Triggers crash (terminates process)

Impact

• Denial of Service: Any application using TensorRT ONNX parser can be crashed
• No recovery: Stack overflow is not catchable, process terminates unconditionally
• Tiny payload: 110 bytes
• Bypasses validation: Passes onnx.checker.check_model()
• Supply chain risk: Malicious model on HuggingFace/model zoo crashes any TRT pipeline

Tested On

• TensorRT 10.15.1.29
• Windows 11, RTX 4080 Super, CUDA 12.x
• Python 3.12