From 3875a6f9980b9183affdc7180a891a12bdc382ca Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Fri, 2 Oct 2026 22:49:27 +0000 Subject: [PATCH 1/4] docs: Update SECURITY.md TRI-1935 --- SECURITY.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 1dbfe3d1..04bee66d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -42,3 +42,48 @@ If reporting a potential vulnerability via email, please encrypt it using NVIDIA 5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. + +## Additional Reporting Channels + +In addition to the channels above, you can use: + +* The [NVIDIA Vulnerability Disclosure Program](https://www.nvidia.com/en-us/security/) (preferred). +* GitHub Private Vulnerability Reporting, via the **Security** tab of this repository, if it is enabled. + +**Do not open a public GitHub issue or pull request for a suspected security vulnerability.** +NVIDIA PSIRT will acknowledge your report, assess it, and coordinate remediation and disclosure with you. + +# Security Architecture & Context + +Perf Analyzer is a command-line performance and load-generation tool, written primarily in C++ (`src/`) with a Python GenAI front end (`genai-perf/`). It drives inference requests against a separately deployed inference service (Triton Inference Server, an OpenAI-compatible API, TensorFlow Serving, TorchServe, or an in-process Triton C API) and reports latency and throughput. It is a client-side developer and benchmarking tool, not a network service: it opens no listening sockets and holds no user data of its own. + +* **Software classification:** CLI application / SDK component. +* **Primary security responsibility:** safely parse operator-supplied arguments and files, and send requests to the configured target without weakening the transport security the operator selected. +* **Key interfaces and boundaries:** + * Command-line arguments (`src/command_line_parser.cc`), including endpoint URLs, TLS options, and extra HTTP headers. + * Input files and directories supplied with `--input-data`, parsed by `src/data_loader.cc`. + * Client backends under `src/client_backend/` (HTTP/gRPC Triton, OpenAI, TensorFlow Serving, TorchServe, dynamic gRPC, Triton C API). + * System and CUDA shared memory used for inputs and outputs (`src/infer_data_manager_shm.cc`, `src/cuda_runtime_library_manager.cc`). + * Output files such as the profile export (`src/profile_data_exporter.cc`). +* **Repository Exposure Classification:** Public (the repository is publicly visible on GitHub). +* **Service Exposure Classification:** Internal-Isolated (medium confidence). The tool is run by developers and CI against test or staging services and does not itself serve external traffic. + +# Threat Model + +1. **Untrusted input data files:** `--input-data` JSON and binary files are parsed in `src/data_loader.cc`. Malformed or oversized files could cause excessive memory use, crashes, or unexpected file reads when file paths are referenced from the data. Treat data sets from untrusted sources as untrusted input. +2. **Command execution through streamed input:** `DataLoader::ReadDataFromPipe` in `src/data_loader.cc` starts a shell process with `popen` to read streaming input data. If the command string is derived from untrusted configuration, it could execute unintended commands with the privileges of the Perf Analyzer user. +3. **Weakened or misconfigured TLS:** HTTPS peer and host verification and gRPC SSL options are set from command-line flags (`--ssl-https-*`, `--ssl-grpc-*`). Disabling verification, or pointing at the wrong certificate files, exposes request payloads and any authorization headers passed with the tool to interception on the network path. +4. **Sensitive headers and payloads in logs and exports:** Custom HTTP headers and request data can be carried into console output and the profile export file written by `src/profile_data_exporter.cc`. Exported files may therefore contain sensitive content and are written with the process's default file permissions. +5. **Dynamic library loading in the Triton C API mode:** `src/client_backend/triton_c_api/shared_library.cc` loads a server library with `dlopen` from a user-supplied `--triton-server-directory`, and `src/mpi_utils.cc` and `src/cuda_runtime_library_manager.cc` load `libmpi.so` and `libcudart.so` by name. A writable or attacker-influenced library path or search path can result in loading of unintended code. +6. **Shared memory exposure:** System and CUDA shared-memory regions and CUDA IPC handles (`src/infer_data_manager_shm.cc`) are shared with the target server. Other local processes with access to the same shared-memory namespace could read or tamper with test tensors, and leftover regions after an abnormal exit can persist. +7. **Build and dependency supply chain:** Builds and the Python `genai-perf` package pull third-party dependencies (see `CMakeLists.txt`, `pyproject.toml`). Unpinned or unverified dependencies could introduce vulnerable or malicious code into released artifacts. + +# Critical Security Assumptions + +* **Trusted operator and environment:** Perf Analyzer is run by a trusted user on a trusted workstation or CI host; command-line arguments, data files, and the server directory are assumed to be controlled by that user. +* **Trusted target service:** The configured endpoint is assumed to be the intended service. The tool does not authenticate the target beyond the TLS settings the operator provides. +* **Operator-controlled TLS:** Transport security is only as strong as the flags supplied. Perf Analyzer's defaults verify peers for HTTPS, but the operator is responsible for enabling TLS where required and not disabling verification outside test environments. +* **Trusted input data:** Input and data-directory files are assumed to be well formed and from a trusted source; the parser is not hardened as a boundary against hostile files. +* **Trusted local libraries:** Shared libraries loaded through `dlopen` and files read from the Triton server directory are assumed to be genuine and not writable by untrusted users. +* **Isolated local host:** Other local users are assumed not to access the process's shared memory, temporary files, or exported profile data. +* **Not for production traffic:** Perf Analyzer is intended for benchmarking and should not be exposed as a service or run with elevated privileges. From c5a9d8441a23d646665b0725ac667868439bdb07 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 18:03:54 +0000 Subject: [PATCH 2/4] docs: Address Greptile review on SECURITY.md TRI-1935 --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 04bee66d..d98e5dde 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -70,10 +70,10 @@ Perf Analyzer is a command-line performance and load-generation tool, written pr # Threat Model -1. **Untrusted input data files:** `--input-data` JSON and binary files are parsed in `src/data_loader.cc`. Malformed or oversized files could cause excessive memory use, crashes, or unexpected file reads when file paths are referenced from the data. Treat data sets from untrusted sources as untrusted input. -2. **Command execution through streamed input:** `DataLoader::ReadDataFromPipe` in `src/data_loader.cc` starts a shell process with `popen` to read streaming input data. If the command string is derived from untrusted configuration, it could execute unintended commands with the privileges of the Perf Analyzer user. +1. **Untrusted input data files:** `--input-data` JSON and binary files are parsed in `src/data_loader.cc`. Malformed or oversized files could cause excessive memory use or crashes. JSON tensor values are not resolved as file paths; in directory mode the loader reads files named after the model's input tensors from the data directory. A `message_generator` string in the JSON is run as a command (see threat 2), so an untrusted `--input-data` file must be treated as untrusted code, not only as untrusted data. +2. **Command execution through streamed input:** `DataLoader::ReadDataFromPipe` in `src/data_loader.cc` starts a shell process with `popen` to read streaming input data. The command string is taken directly from the `message_generator` field of the `--input-data` JSON (`DataLoader::ReadTensorData`), so loading an untrusted input-data file can execute arbitrary commands with the privileges of the Perf Analyzer user. Never use `--input-data` files from untrusted sources. 3. **Weakened or misconfigured TLS:** HTTPS peer and host verification and gRPC SSL options are set from command-line flags (`--ssl-https-*`, `--ssl-grpc-*`). Disabling verification, or pointing at the wrong certificate files, exposes request payloads and any authorization headers passed with the tool to interception on the network path. -4. **Sensitive headers and payloads in logs and exports:** Custom HTTP headers and request data can be carried into console output and the profile export file written by `src/profile_data_exporter.cc`. Exported files may therefore contain sensitive content and are written with the process's default file permissions. +4. **Sensitive headers and payloads in logs and exports:** The profile export file written by `src/profile_data_exporter.cc` records request inputs, response outputs and timestamps, but not HTTP headers. Exported files may therefore contain sensitive payload content and are written with the process's default file permissions. Verbose console output from the client libraries may also include request details such as headers, so treat console logs as sensitive. 5. **Dynamic library loading in the Triton C API mode:** `src/client_backend/triton_c_api/shared_library.cc` loads a server library with `dlopen` from a user-supplied `--triton-server-directory`, and `src/mpi_utils.cc` and `src/cuda_runtime_library_manager.cc` load `libmpi.so` and `libcudart.so` by name. A writable or attacker-influenced library path or search path can result in loading of unintended code. 6. **Shared memory exposure:** System and CUDA shared-memory regions and CUDA IPC handles (`src/infer_data_manager_shm.cc`) are shared with the target server. Other local processes with access to the same shared-memory namespace could read or tamper with test tensors, and leftover regions after an abnormal exit can persist. 7. **Build and dependency supply chain:** Builds and the Python `genai-perf` package pull third-party dependencies (see `CMakeLists.txt`, `pyproject.toml`). Unpinned or unverified dependencies could introduce vulnerable or malicious code into released artifacts. From 6753d05997769b8a19f8d5940a24baa7904fdcc8 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 19:30:17 +0000 Subject: [PATCH 3/4] docs: Simplify SECURITY.md TRI-1935 --- SECURITY.md | 74 +++++++++++++++++++++++------------------------------ 1 file changed, 32 insertions(+), 42 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d98e5dde..c83686a9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -45,45 +45,35 @@ See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins an ## Additional Reporting Channels -In addition to the channels above, you can use: - -* The [NVIDIA Vulnerability Disclosure Program](https://www.nvidia.com/en-us/security/) (preferred). -* GitHub Private Vulnerability Reporting, via the **Security** tab of this repository, if it is enabled. - -**Do not open a public GitHub issue or pull request for a suspected security vulnerability.** -NVIDIA PSIRT will acknowledge your report, assess it, and coordinate remediation and disclosure with you. - -# Security Architecture & Context - -Perf Analyzer is a command-line performance and load-generation tool, written primarily in C++ (`src/`) with a Python GenAI front end (`genai-perf/`). It drives inference requests against a separately deployed inference service (Triton Inference Server, an OpenAI-compatible API, TensorFlow Serving, TorchServe, or an in-process Triton C API) and reports latency and throughput. It is a client-side developer and benchmarking tool, not a network service: it opens no listening sockets and holds no user data of its own. - -* **Software classification:** CLI application / SDK component. -* **Primary security responsibility:** safely parse operator-supplied arguments and files, and send requests to the configured target without weakening the transport security the operator selected. -* **Key interfaces and boundaries:** - * Command-line arguments (`src/command_line_parser.cc`), including endpoint URLs, TLS options, and extra HTTP headers. - * Input files and directories supplied with `--input-data`, parsed by `src/data_loader.cc`. - * Client backends under `src/client_backend/` (HTTP/gRPC Triton, OpenAI, TensorFlow Serving, TorchServe, dynamic gRPC, Triton C API). - * System and CUDA shared memory used for inputs and outputs (`src/infer_data_manager_shm.cc`, `src/cuda_runtime_library_manager.cc`). - * Output files such as the profile export (`src/profile_data_exporter.cc`). -* **Repository Exposure Classification:** Public (the repository is publicly visible on GitHub). -* **Service Exposure Classification:** Internal-Isolated (medium confidence). The tool is run by developers and CI against test or staging services and does not itself serve external traffic. - -# Threat Model - -1. **Untrusted input data files:** `--input-data` JSON and binary files are parsed in `src/data_loader.cc`. Malformed or oversized files could cause excessive memory use or crashes. JSON tensor values are not resolved as file paths; in directory mode the loader reads files named after the model's input tensors from the data directory. A `message_generator` string in the JSON is run as a command (see threat 2), so an untrusted `--input-data` file must be treated as untrusted code, not only as untrusted data. -2. **Command execution through streamed input:** `DataLoader::ReadDataFromPipe` in `src/data_loader.cc` starts a shell process with `popen` to read streaming input data. The command string is taken directly from the `message_generator` field of the `--input-data` JSON (`DataLoader::ReadTensorData`), so loading an untrusted input-data file can execute arbitrary commands with the privileges of the Perf Analyzer user. Never use `--input-data` files from untrusted sources. -3. **Weakened or misconfigured TLS:** HTTPS peer and host verification and gRPC SSL options are set from command-line flags (`--ssl-https-*`, `--ssl-grpc-*`). Disabling verification, or pointing at the wrong certificate files, exposes request payloads and any authorization headers passed with the tool to interception on the network path. -4. **Sensitive headers and payloads in logs and exports:** The profile export file written by `src/profile_data_exporter.cc` records request inputs, response outputs and timestamps, but not HTTP headers. Exported files may therefore contain sensitive payload content and are written with the process's default file permissions. Verbose console output from the client libraries may also include request details such as headers, so treat console logs as sensitive. -5. **Dynamic library loading in the Triton C API mode:** `src/client_backend/triton_c_api/shared_library.cc` loads a server library with `dlopen` from a user-supplied `--triton-server-directory`, and `src/mpi_utils.cc` and `src/cuda_runtime_library_manager.cc` load `libmpi.so` and `libcudart.so` by name. A writable or attacker-influenced library path or search path can result in loading of unintended code. -6. **Shared memory exposure:** System and CUDA shared-memory regions and CUDA IPC handles (`src/infer_data_manager_shm.cc`) are shared with the target server. Other local processes with access to the same shared-memory namespace could read or tamper with test tensors, and leftover regions after an abnormal exit can persist. -7. **Build and dependency supply chain:** Builds and the Python `genai-perf` package pull third-party dependencies (see `CMakeLists.txt`, `pyproject.toml`). Unpinned or unverified dependencies could introduce vulnerable or malicious code into released artifacts. - -# Critical Security Assumptions - -* **Trusted operator and environment:** Perf Analyzer is run by a trusted user on a trusted workstation or CI host; command-line arguments, data files, and the server directory are assumed to be controlled by that user. -* **Trusted target service:** The configured endpoint is assumed to be the intended service. The tool does not authenticate the target beyond the TLS settings the operator provides. -* **Operator-controlled TLS:** Transport security is only as strong as the flags supplied. Perf Analyzer's defaults verify peers for HTTPS, but the operator is responsible for enabling TLS where required and not disabling verification outside test environments. -* **Trusted input data:** Input and data-directory files are assumed to be well formed and from a trusted source; the parser is not hardened as a boundary against hostile files. -* **Trusted local libraries:** Shared libraries loaded through `dlopen` and files read from the Triton server directory are assumed to be genuine and not writable by untrusted users. -* **Isolated local host:** Other local users are assumed not to access the process's shared memory, temporary files, or exported profile data. -* **Not for production traffic:** Perf Analyzer is intended for benchmarking and should not be exposed as a service or run with elevated privileges. +1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ +2. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. + +**Do not open a public issue or pull request to report a vulnerability.** + +## Security Architecture and Context + +**Project:** perf_analyzer is part of the Triton Inference Server project. + +**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. + +**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. + +**Repository Exposure Classification:** Public. + +**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. + +## Threat Model + +1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. +2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. +3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. +4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. +5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. + +## Critical Security Assumptions + +* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. +* Models, configuration and other inputs come from trusted sources. +* Dependencies and the build environment are kept up to date and obtained from trusted sources. +* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. +* Host operating system, driver and hardware security are the operator's responsibility. From 8ea6718806c5c114a6ebb78ed7b9cc0bcb0d932e Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 21:33:59 +0000 Subject: [PATCH 4/4] docs: Adopt current NVIDIA SECURITY.md template TRI-1935 --- SECURITY.md | 60 +++++++++++++++-------------------------------------- 1 file changed, 17 insertions(+), 43 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c83686a9..e3a279a4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,54 +26,28 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> -# Report a Security Vulnerability +## Security -To report a potential security vulnerability in any NVIDIA product, please use either: -* [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html), or -* Send email to psirt@nvidia.com +NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. -**OEM Partners should contact their NVIDIA Customer Program Manager** +If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub/GitLab.** If a potential security issue is inadvertently reported via a public issue or pull request, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels. -If reporting a potential vulnerability via email, please encrypt it using NVIDIA’s public PGP key ([see PGP Key page](https://www.nvidia.com/en-us/security/pgp-key/)) and include the following information: -1. Product/Driver name and version/branch that contains the vulnerability -2. Type of vulnerability (code execution, denial of service, buffer overflow, etc.) -3. Instructions to reproduce the vulnerability -4. Proof-of-concept or exploit code -5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability +## Reporting Potential Security Vulnerability in an NVIDIA Product -See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. +To report a potential security vulnerability in any NVIDIA product: -## Additional Reporting Channels +- Web: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) +- E-Mail: psirt@nvidia.com + - We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key) + - Please include the following information: + - Product/Driver name and version/branch that contains the vulnerability + - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) + - Instructions to reproduce the vulnerability + - Proof-of-concept or exploit code + - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability -1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ -2. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. +While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy. Please visit our [Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/) policies page for more information. -**Do not open a public issue or pull request to report a vulnerability.** +## NVIDIA Product Security -## Security Architecture and Context - -**Project:** perf_analyzer is part of the Triton Inference Server project. - -**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. - -**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. - -**Repository Exposure Classification:** Public. - -**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. - -## Threat Model - -1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. -2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. -3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. -4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. -5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. - -## Critical Security Assumptions - -* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. -* Models, configuration and other inputs come from trusted sources. -* Dependencies and the build environment are kept up to date and obtained from trusted sources. -* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. -* Host operating system, driver and hardware security are the operator's responsibility. +For all security-related concerns, please visit NVIDIA's Product Security portal at https://www.nvidia.com/en-us/security