Heap OOB in TFLite
Moderate severity
GitHub Reviewed
Published
Aug 11, 2021
in
tensorflow/tensorflow
•
Updated Feb 9, 2023
Package
Affected versions
< 2.3.4
>= 2.4.0, < 2.4.3
= 2.5.0
Patched versions
2.3.4
2.4.3
2.5.1
Description
Published by the National Vulnerability Database
Aug 12, 2021
Reviewed
Aug 24, 2021
Published to the GitHub Advisory Database
Aug 25, 2021
Last updated
Feb 9, 2023
Impact
TFLite's
expand_dims.cc
contains a vulnerability which allows reading one element outside of bounds of heap allocated data:If
axis
is a large negative value (e.g.,-100000
), then after the firstif
it would still be negative. The check following theif
statement will pass and thefor
loop would read one element before the start ofinput_dims.data
(wheni = 0
).Patches
We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
References