CVE-2020-15201: Improper Input Validation
(updated )
In Tensorflow, the RaggedCountSparseOutput
implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits
tensor generate a valid partitioning of the values
tensor. Hence, the code is prone to heap buffer overflow. If split_values
does not end with a value at least num_values
then the while
loop condition will trigger a read outside the bounds of split_values
once batch_idx
grows too large.
References
Detect and mitigate CVE-2020-15201 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →