CVE-2021-37658: Access of Uninitialized Pointer
(updated )
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.raw_ops.MatrixSetDiagV*
. The implementation has incomplete validation that the value of k
is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong.
References
Detect and mitigate CVE-2021-37658 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →