CVE-2022-23593: Segfault in `simplifyBroadcast` in Tensorflow

(updated )

The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.

size_t maxRank = 0;
for (auto shape : llvm::enumerate(shapes)) {
auto found_shape = analysis.dimensionsForShapeTensor(shape.value());
if (!found_shape) return {};
shapes_found.push_back(*found_shape);
maxRank = std::max(maxRank, found_shape->size());
}

SmallVector<const ShapeComponentAnalysis::SymbolicDimension*>
joined_dimensions(maxRank);

If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-23593 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →