Vulnerabilities

ONNX before 1.21.0 contains a symlink-following and time-of-check-to-time-of-use flaw in its save_external_data function, which builds the external-data output path from the model's external_data location field and opens it for writing without O_NOFOLLOW/O_EXCL after a non-atomic os.path.isfile() check. A local attacker with write access to the directory where a victim serializes a model's external data can pre-plant a symlink at the expected path, causing the victim's write to follow it. As a result, the attacker can append attacker-influenced content to any file the victim can write, such as ~/.ssh/authorized_keys, cron files, or application configs, potentially achieving code execution or persistence in the victim's user context. Any Python environment running a vulnerable onnx version and saving models with external data, particularly on shared or multi-user systems, is affected. No exploitation is known in the wild; one public advisory/PoC reference exists and EPSS is 0.1% (1st percentile).

Do: Upgrade the onnx pip package to 1.21.0 or later. As an interim mitigation, serialize model external data only into directories exclusively writable by the running user, and audit services, cron jobs, and pipelines on shared or multi-user hosts that call save_external_data for vulnerable usage.

CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.

Do: Apply updated kernels from your distribution or vendor (Fedora kernel updates; NetApp fixes are delivered via the HCI firmware updates in its security advisory) and prioritize internet-exposed, multi-user hosts per CISA BOD 26-04, including the required forensics triage checks. Because exploitation requires local access, restrict untrusted local code execution and shell access on unpatched systems, and hunt for signs of local privilege escalation on high-exposure hosts. After remediation, verify the patched kernel package is installed and that the running kernel has actually been booted into the fixed version.