CVE-2022-23557: Division by zero in TFLite

(updated )

An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation:

inline void BiasAndClamp(float clamp_min, float clamp_max, int bias_size,
const float* bias_data, int array_size,
float* array_data) {
// ...
TFLITE_DCHECK_EQ((array_size % bias_size), 0);
// ...
}

There is no check that the bias_size is non zero.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-23557 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →