Path Traversal in Tenstorrent tt-metal

Executive Summary

This vulnerability is a path traversal issue in Tenstorrent tt-metal up to version 0.80.0. The function load_hf_state_dict_filtered in models/tt_transformers/tt/load_checkpoints.py improperly handles shard filenames from model.safetensors.index.json without validating paths. Attackers can manipulate the weight_map argument to include relative or absolute paths like ../../x.safetensors, causing the loader to read files outside the intended checkpoint directory. This enables arbitrary file reads and model weight poisoning.

Useful 0 Not Useful 0

Detection Guidance

Check for vulnerable tt-metal versions by running: pip show tt-metal or git log --oneline | grep 4851ccf. Inspect model.safetensors.index.json files for suspicious paths like ../../ or absolute paths in weight_map entries. Monitor logs for ValueError exceptions during model loading which may indicate path traversal attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use affected versions of tt-metal, an attacker could exploit this to load malicious model weights from outside the intended directory. This could lead to silent weight poisoning or backdoor insertion in your models, compromising model integrity and potentially leaking sensitive data from safetensors files. The attack requires you to load a model from a local directory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. The path traversal flaw allows attackers to load external files into the model's state dictionary, which may include sensitive information stored outside intended directories. This could lead to data breaches, violating confidentiality requirements under both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade tt-metal to version 0.81.0-dev20261016 or later. If immediate upgrade is not possible, avoid loading local model checkpoints and use Hugging Face Hub mode which enforces path restrictions. Review all model.safetensors.index.json files for malicious paths before loading models.

Useful 0 Not Useful 0