CVE-2022-23592: Out of bounds read in Tensorflow

(updated )

TensorFlow’s type inference can cause a heap OOB read as the bounds checking is done in a DCHECK (which is a no-op during production):

if (node_t.type_id() != TFT_UNSET) {
int ix = input_idx[i];
DCHECK(ix < node_t.args_size())
<< "input " << i << " should have an output " << ix
<< " but instead only has " << node_t.args_size()
<< " outputs: " << node_t.DebugString();
input_types.emplace_back(node_t.args(ix));
// ...
}

An attacker can control input_idx such that ix would be larger than the number of values in node_t.args.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-23592 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →