CVE-2020-15200: Improper Input Validation
(updated )
In Tensorflow, the RaggedCountSparseOutput
implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits
tensor generate a valid partitioning of the values
tensor. Thus, the code sets up conditions to cause a heap buffer overflow. A BatchedMap
is equivalent to a vector where each element is a hashmap. However, if the first element of splits_values
is not 0, batch_idx
will never be 1, hence there will be no hashmap at index 0 in per_batch_counts
. Trying to access that in the user code results in a segmentation fault.
References
Detect and mitigate CVE-2020-15200 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →