Vulnerabilities

ONNX before 1.21.0 contains a symlink-following and time-of-check-to-time-of-use flaw in its save_external_data function, which builds the external-data output path from the model's external_data location field and opens it for writing without O_NOFOLLOW/O_EXCL after a non-atomic os.path.isfile() check. A local attacker with write access to the directory where a victim serializes a model's external data can pre-plant a symlink at the expected path, causing the victim's write to follow it. As a result, the attacker can append attacker-influenced content to any file the victim can write, such as ~/.ssh/authorized_keys, cron files, or application configs, potentially achieving code execution or persistence in the victim's user context. Any Python environment running a vulnerable onnx version and saving models with external data, particularly on shared or multi-user systems, is affected. No exploitation is known in the wild; one public advisory/PoC reference exists and EPSS is 0.1% (1st percentile).

Do: Upgrade the onnx pip package to 1.21.0 or later. As an interim mitigation, serialize model external data only into directories exclusively writable by the running user, and audit services, cron jobs, and pipelines on shared or multi-user hosts that call save_external_data for vulnerable usage.

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion. KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name: BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site. Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.