In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, to mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds. If the `DCHECK` does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption. The issue is patched in commit 2d88f470dea2671b430884260f3626b1fe99830a, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
CVSS Details
- CVSS 3.1 Base Score: 8.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade tensorflow2-gnu-hpcUpgrade libtensorflow_framework2-gnu-openmpi2-hpcUpgrade tensorflow2-lite-develUpgrade tensorflow2_2_1_2-gnu-hpcUpgrade libtensorflow_framework2-gnu-hpcUpgrade libtensorflow2-gnu-hpcUpgrade tensorflow2Upgrade tensorflow2-docUpgrade tensorflow2_2_1_2-gnu-openmpi2-hpc-docUpgrade libtensorflow_cc2-gnu-openmpi2-hpcUpgrade tensorflow2_2_1_2-gnu-openmpi2-hpcUpgrade libtensorflow2-gnu-openmpi2-hpcUpgrade tensorflow2_2_1_2-gnu-openmpi2-hpc-develUpgrade tensorflow2_2_1_2-gnu-hpc-docUpgrade libtensorflow_cc2Upgrade libtensorflow_framework2Upgrade tensorflow2-develUpgrade libtensorflow2Upgrade tensorflow2-gnu-openmpi2-hpcUpgrade tensorflow2-liteUpgrade libtensorflow_cc2-gnu-hpcUpgrade tensorflow2_2_1_2-gnu-hpc-devel | Mar 18, 2021 | Sep 25, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub