CVE-2021-37681: NPE in TFLite
(updated )
The implementation of SVDF in TFLite is vulnerable to a null pointer error:
TfLiteTensor* state = GetVariableInput(context, node, kStateTensor);
// ...
GetTensorData<float>(state)
The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.
TfLiteTensor* GetVariableInput(TfLiteContext* context, const TfLiteNode* node,
int index) {
TfLiteTensor* tensor = GetMutableInput(context, node, index);
return tensor->is_variable ? tensor : nullptr;
}
Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->is_variable expression can also trigger a null pointer exception.
References
- github.com/advisories/GHSA-7xwj-5r4v-429p
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-594.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-792.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-303.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/svdf.cc
- github.com/tensorflow/tensorflow/commit/5b048e87e4e55990dae6b547add4dae59f4e1c76
- github.com/tensorflow/tensorflow/security/advisories/GHSA-7xwj-5r4v-429p
- nvd.nist.gov/vuln/detail/CVE-2021-37681
Code Behaviors & Features
Detect and mitigate CVE-2021-37681 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →