From e09ba7938efde6e75fefb77d4602a10b88ba0620 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Fri, 2 Oct 2026 20:58:10 +0000 Subject: [PATCH 1/6] docs: Add SECURITY.md TRI-1935 --- SECURITY.md | 143 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 143 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5672548 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,143 @@ + + +# Security Policy + +## Reporting a Vulnerability + +Please do **not** report security vulnerabilities through public GitHub +issues, discussions, or pull requests. + +To report a potential security vulnerability in any NVIDIA product, use one of +the following channels: + +1. **NVIDIA Vulnerability Disclosure Program** (preferred): + +2. **Email:** [psirt@nvidia.com](mailto:psirt@nvidia.com). Please encrypt + sensitive reports with NVIDIA's public PGP key: + +3. **GitHub Private Vulnerability Reporting:** use the "Report a + vulnerability" button on this repository's **Security** tab, where enabled. + +Please include: + +1. Product name and version, branch, or commit that contains the + vulnerability. +2. Type of vulnerability (for example code execution, denial of service, + buffer overflow, path traversal). +3. Step-by-step instructions to reproduce the issue. +4. Proof-of-concept or exploit code, if available. +5. Potential impact, including how an attacker could exploit the issue. + +NVIDIA PSIRT acknowledges reports, assesses them, and coordinates fixes and +disclosure with the reporter. OEM partners should contact their NVIDIA +Customer Program Manager. Past bulletins are listed at +. + +## Security Architecture and Context + +**Project:** Triton Developer Tools, a set of helper libraries and tooling +for building applications on top of the Triton Inference Server. + +**Classification:** Library / SDK, plus build and development tooling. It is +not a network service and does not open listening sockets itself. + +**Components:** + +- `server/` is a C++17 wrapper library (`TritonServer`, `InferRequest`, + `InferResult`, and a trace manager) over the in-process Triton Server C API + (`libtritonserver`), with example programs and a unit test. +- `tools/add_copyright.py` and `.pre-commit-hooks.yaml` provide the + `add-license` pre-commit hook used by Triton repositories. It reads and + rewrites source files in the repository where it runs. +- `server/install_dependencies_and_build.sh` installs build dependencies and + builds the wrapper. +- `qa/` contains test scripts and sample Python model fixtures. + +**Primary security responsibility:** correct handling of caller-supplied model +repository paths, tensor buffers, memory types, and trace file paths when +passing them to the Triton core library, and safe, bounded file modification +by the license hook. + +**Key boundaries and interfaces:** + +- The public C++ API in `server/include/triton/developer_tools/`. +- Pre-commit hook invocation with file paths supplied by pre-commit. +- Build-time package installation and downloads. + +**Repository Exposure Classification:** Public. Basis: the repository is +publicly visible on GitHub. + +**Service Exposure Classification:** Internal-Isolated, medium confidence. +Basis: the code is an embedded library and developer tool with no network +listeners and no authentication surface of its own. Exposure is inherited +from the application that embeds it. + +## Threat Model + +1. **Untrusted model repository or model content:** `TritonServer::Create` + accepts a model repository path from the embedding application. A + repository containing a malicious model or backend library can execute + code in the host process, because models and backends are loaded + in-process. +2. **Unsafe buffer and memory handling in the tensor API:** `InferRequest` + and `Tensor` accept caller-provided buffers, sizes, data types, and memory + types (CPU, pinned, GPU). Mismatched sizes or types supplied by a caller + can lead to out-of-bounds reads or writes in the C++ wrapper. +3. **Trace file path abuse:** the trace manager in `server/src/tracer.cc` + writes trace output to caller-supplied file paths. An attacker who + controls that path or its location may overwrite files or cause + unbounded disk usage through a high trace rate. +4. **Unintended file modification by the license hook:** + `tools/add_copyright.py` rewrites files in place. Running it on untrusted + or unexpected paths, or through symlinks, can modify files outside the + intended repository. +5. **Build-time supply chain:** `server/install_dependencies_and_build.sh` + adds an external package repository and signing key and installs a pinned + CMake version. Compromise of that source or of the build base image would + affect built artifacts. +6. **Pre-commit consumers pinned by tag:** downstream repositories consume + the `add-license` hook by tag. Replacing or moving a tag would change code + executed on every contributor's machine and in CI. + +## Critical Security Assumptions + +- The embedding application is trusted and is responsible for authenticating + and authorizing its own users. This library provides no authentication, + authorization, or TLS. +- Model repositories, backends, and shared libraries loaded by Triton come + from trusted sources. The library does not verify their integrity. +- Callers validate tensor shapes, sizes, data types, and memory types before + passing them to the wrapper. +- Trace file paths are chosen by the application operator and are not + attacker-controlled. The destination has sufficient disk space and + appropriate permissions. +- The license hook runs only against files inside a trusted working tree. +- Build environments, base images, and package mirrors used for + `install_dependencies_and_build.sh` are trusted. +- Release tags are write-once and are not moved after publication. From cccc93b96c66f197086a078f14220a3bb7918419 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 18:02:48 +0000 Subject: [PATCH 2/6] docs: Address Greptile review on SECURITY.md TRI-1935 --- SECURITY.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 5672548..d352609 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -69,7 +69,7 @@ not a network service and does not open listening sockets itself. **Components:** -- `server/` is a C++17 wrapper library (`TritonServer`, `InferRequest`, +- `server/` is a C++11 wrapper library (`TritonServer`, `InferRequest`, `InferResult`, and a trace manager) over the in-process Triton Server C API (`libtritonserver`), with example programs and a unit test. - `tools/add_copyright.py` and `.pre-commit-hooks.yaml` provide the @@ -119,7 +119,11 @@ from the application that embeds it. intended repository. 5. **Build-time supply chain:** `server/install_dependencies_and_build.sh` adds an external package repository and signing key and installs a pinned - CMake version. Compromise of that source or of the build base image would + CMake version. At CMake configure time, `server/CMakeLists.txt` also + fetches the `common` and `core` repositories from Git, and + `TRITON_COMMON_REPO_TAG` and `TRITON_CORE_REPO_TAG` default to `main`, a + moving ref; pinning them to release tags is the available control. + Compromise of any of these sources or of the build base image would affect built artifacts. 6. **Pre-commit consumers pinned by tag:** downstream repositories consume the `add-license` hook by tag. Replacing or moving a tag would change code From 152743e8d4752b7ed04910bebf280b9363c1ac3f Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 19:29:10 +0000 Subject: [PATCH 3/6] docs: Simplify SECURITY.md TRI-1935 --- SECURITY.md | 125 ++++++++++++---------------------------------------- 1 file changed, 29 insertions(+), 96 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d352609..b94ef2d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -30,118 +30,51 @@ ## Reporting a Vulnerability -Please do **not** report security vulnerabilities through public GitHub -issues, discussions, or pull requests. +NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. -To report a potential security vulnerability in any NVIDIA product, use one of -the following channels: +To report a potential security vulnerability, please use one of the following channels: -1. **NVIDIA Vulnerability Disclosure Program** (preferred): - -2. **Email:** [psirt@nvidia.com](mailto:psirt@nvidia.com). Please encrypt - sensitive reports with NVIDIA's public PGP key: - -3. **GitHub Private Vulnerability Reporting:** use the "Report a - vulnerability" button on this repository's **Security** tab, where enabled. +1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ +2. **Web form:** [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) +3. **Email:** [NVIDIA PSIRT](mailto:psirt@nvidia.com). Please encrypt sensitive reports with NVIDIA's [PGP key](https://www.nvidia.com/en-us/security/pgp-key). +4. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. + +**Do not open a public issue or pull request to report a vulnerability.** Please include: -1. Product name and version, branch, or commit that contains the - vulnerability. -2. Type of vulnerability (for example code execution, denial of service, - buffer overflow, path traversal). -3. Step-by-step instructions to reproduce the issue. -4. Proof-of-concept or exploit code, if available. -5. Potential impact, including how an attacker could exploit the issue. +* Product or component name and version or branch +* Type of vulnerability +* Steps to reproduce +* Proof of concept, if available +* Potential impact and how it could be exploited -NVIDIA PSIRT acknowledges reports, assesses them, and coordinates fixes and -disclosure with the reporter. OEM partners should contact their NVIDIA -Customer Program Manager. Past bulletins are listed at -. +See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. ## Security Architecture and Context -**Project:** Triton Developer Tools, a set of helper libraries and tooling -for building applications on top of the Triton Inference Server. - -**Classification:** Library / SDK, plus build and development tooling. It is -not a network service and does not open listening sockets itself. - -**Components:** - -- `server/` is a C++11 wrapper library (`TritonServer`, `InferRequest`, - `InferResult`, and a trace manager) over the in-process Triton Server C API - (`libtritonserver`), with example programs and a unit test. -- `tools/add_copyright.py` and `.pre-commit-hooks.yaml` provide the - `add-license` pre-commit hook used by Triton repositories. It reads and - rewrites source files in the repository where it runs. -- `server/install_dependencies_and_build.sh` installs build dependencies and - builds the wrapper. -- `qa/` contains test scripts and sample Python model fixtures. - -**Primary security responsibility:** correct handling of caller-supplied model -repository paths, tensor buffers, memory types, and trace file paths when -passing them to the Triton core library, and safe, bounded file modification -by the license hook. +**Project:** developer_tools is part of the Triton Inference Server project. -**Key boundaries and interfaces:** +**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. -- The public C++ API in `server/include/triton/developer_tools/`. -- Pre-commit hook invocation with file paths supplied by pre-commit. -- Build-time package installation and downloads. +**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. -**Repository Exposure Classification:** Public. Basis: the repository is -publicly visible on GitHub. +**Repository Exposure Classification:** Public. -**Service Exposure Classification:** Internal-Isolated, medium confidence. -Basis: the code is an embedded library and developer tool with no network -listeners and no authentication surface of its own. Exposure is inherited -from the application that embeds it. +**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. ## Threat Model -1. **Untrusted model repository or model content:** `TritonServer::Create` - accepts a model repository path from the embedding application. A - repository containing a malicious model or backend library can execute - code in the host process, because models and backends are loaded - in-process. -2. **Unsafe buffer and memory handling in the tensor API:** `InferRequest` - and `Tensor` accept caller-provided buffers, sizes, data types, and memory - types (CPU, pinned, GPU). Mismatched sizes or types supplied by a caller - can lead to out-of-bounds reads or writes in the C++ wrapper. -3. **Trace file path abuse:** the trace manager in `server/src/tracer.cc` - writes trace output to caller-supplied file paths. An attacker who - controls that path or its location may overwrite files or cause - unbounded disk usage through a high trace rate. -4. **Unintended file modification by the license hook:** - `tools/add_copyright.py` rewrites files in place. Running it on untrusted - or unexpected paths, or through symlinks, can modify files outside the - intended repository. -5. **Build-time supply chain:** `server/install_dependencies_and_build.sh` - adds an external package repository and signing key and installs a pinned - CMake version. At CMake configure time, `server/CMakeLists.txt` also - fetches the `common` and `core` repositories from Git, and - `TRITON_COMMON_REPO_TAG` and `TRITON_CORE_REPO_TAG` default to `main`, a - moving ref; pinning them to release tags is the available control. - Compromise of any of these sources or of the build base image would - affect built artifacts. -6. **Pre-commit consumers pinned by tag:** downstream repositories consume - the `add-license` hook by tag. Replacing or moving a tag would change code - executed on every contributor's machine and in CI. +1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. +2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. +3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. +4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. +5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. ## Critical Security Assumptions -- The embedding application is trusted and is responsible for authenticating - and authorizing its own users. This library provides no authentication, - authorization, or TLS. -- Model repositories, backends, and shared libraries loaded by Triton come - from trusted sources. The library does not verify their integrity. -- Callers validate tensor shapes, sizes, data types, and memory types before - passing them to the wrapper. -- Trace file paths are chosen by the application operator and are not - attacker-controlled. The destination has sufficient disk space and - appropriate permissions. -- The license hook runs only against files inside a trusted working tree. -- Build environments, base images, and package mirrors used for - `install_dependencies_and_build.sh` are trusted. -- Release tags are write-once and are not moved after publication. +* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. +* Models, configuration and other inputs come from trusted sources. +* Dependencies and the build environment are kept up to date and obtained from trusted sources. +* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. +* Host operating system, driver and hardware security are the operator's responsibility. From c5525902b8715ce428ba4806baa93fcc4917e408 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 20:23:06 +0000 Subject: [PATCH 4/6] docs: Use standard NVIDIA SECURITY.md TRI-1935 --- SECURITY.md | 58 ++++++++++------------------------------------------- 1 file changed, 11 insertions(+), 47 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b94ef2d..df20980 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,55 +26,19 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> -# Security Policy +# Report a Security Vulnerability -## Reporting a Vulnerability +To report a potential security vulnerability in any NVIDIA product, please use either: +* This web form: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html), or +* Send email to: [NVIDIA PSIRT](mailto:psirt@nvidia.com) -NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. +**OEM Partners should contact their NVIDIA Customer Program Manager** -To report a potential security vulnerability, please use one of the following channels: - -1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ -2. **Web form:** [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) -3. **Email:** [NVIDIA PSIRT](mailto:psirt@nvidia.com). Please encrypt sensitive reports with NVIDIA's [PGP key](https://www.nvidia.com/en-us/security/pgp-key). -4. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. - -**Do not open a public issue or pull request to report a vulnerability.** - -Please include: - -* Product or component name and version or branch -* Type of vulnerability -* Steps to reproduce -* Proof of concept, if available -* Potential impact and how it could be exploited +If reporting a potential vulnerability via email, please encrypt it using NVIDIA’s public PGP key ([see PGP Key page](https://www.nvidia.com/en-us/security/pgp-key/)) and include the following information: +1. Product/Driver name and version/branch that contains the vulnerability +2. Type of vulnerability (code execution, denial of service, buffer overflow, etc.) +3. Instructions to reproduce the vulnerability +4. Proof-of-concept or exploit code +5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. - -## Security Architecture and Context - -**Project:** developer_tools is part of the Triton Inference Server project. - -**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. - -**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. - -**Repository Exposure Classification:** Public. - -**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. - -## Threat Model - -1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. -2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. -3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. -4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. -5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. - -## Critical Security Assumptions - -* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. -* Models, configuration and other inputs come from trusted sources. -* Dependencies and the build environment are kept up to date and obtained from trusted sources. -* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. -* Host operating system, driver and hardware security are the operator's responsibility. From f9cb38b5a32747c3a2ac509fc89427bd8d2b5b87 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 21:11:45 +0000 Subject: [PATCH 5/6] docs: Add vulnerability reporting guidance to SECURITY.md TRI-1935 --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index df20980..b600f85 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -42,3 +42,5 @@ If reporting a potential vulnerability via email, please encrypt it using NVIDIA 5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. + +**Please do not report security vulnerabilities through public issues or other public channels.** From cd40ee7f81fc46f2d89d52ff2fb9a348ba724aef Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 21:34:44 +0000 Subject: [PATCH 6/6] docs: Adopt current NVIDIA SECURITY.md template TRI-1935 --- SECURITY.md | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b600f85..0f8d3b0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,21 +26,28 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> -# Report a Security Vulnerability +## Security -To report a potential security vulnerability in any NVIDIA product, please use either: -* This web form: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html), or -* Send email to: [NVIDIA PSIRT](mailto:psirt@nvidia.com) +NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. -**OEM Partners should contact their NVIDIA Customer Program Manager** +If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub/GitLab.** If a potential security issue is inadvertently reported via a public issue or pull request, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels. -If reporting a potential vulnerability via email, please encrypt it using NVIDIA’s public PGP key ([see PGP Key page](https://www.nvidia.com/en-us/security/pgp-key/)) and include the following information: -1. Product/Driver name and version/branch that contains the vulnerability -2. Type of vulnerability (code execution, denial of service, buffer overflow, etc.) -3. Instructions to reproduce the vulnerability -4. Proof-of-concept or exploit code -5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability +## Reporting Potential Security Vulnerability in an NVIDIA Product -See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. +To report a potential security vulnerability in any NVIDIA product: -**Please do not report security vulnerabilities through public issues or other public channels.** +- Web: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) +- E-Mail: psirt@nvidia.com + - We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key) + - Please include the following information: + - Product/Driver name and version/branch that contains the vulnerability + - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) + - Instructions to reproduce the vulnerability + - Proof-of-concept or exploit code + - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability + +While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy. Please visit our [Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/) policies page for more information. + +## NVIDIA Product Security + +For all security-related concerns, please visit NVIDIA's Product Security portal at https://www.nvidia.com/en-us/security