Heap buffer overflow in `QuantizedResizeBilinear`
Package
Affected versions
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Patched versions
2.1.4
2.2.3
2.3.3
2.4.2
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
2.1.4
2.2.3
2.3.3
2.4.2
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
2.1.4
2.2.3
2.3.3
2.4.2
Description
Published by the National Vulnerability Database
May 14, 2021
Reviewed
May 18, 2021
Published to the GitHub Advisory Database
May 21, 2021
Last updated
Oct 30, 2024
Impact
An attacker can cause a heap buffer overflow in
QuantizedResizeBilinear
by passing in invalid thresholds for the quantization:This is because the implementation assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly:
However, if any of these tensors is empty, then
.flat<T>()
is an empty buffer and accessing the element at position 0 results in overflow.Patches
We have patched the issue in GitHub commit f6c40f0c6cbf00d46c7717a26419f2062f2f8694.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
References