CVE-2021-37682: Use of unitialized value in TFLite
(updated )
All TFLite operations that use quantization can be made to use unitialized values. For example:
const auto* affine_quantization =
reinterpret_cast<TfLiteAffineQuantization*>(
filter->quantization.params);
The issue stems from the fact that quantization.params is only valid if quantization.type is different that kTfLiteNoQuantization. However, these checks are missing in large parts of the code.
References
- github.com/advisories/GHSA-4c4g-crqm-xrxw
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-595.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-793.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-304.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc
- github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5
- github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887
- github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538
- github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxw
- nvd.nist.gov/vuln/detail/CVE-2021-37682
Code Behaviors & Features
Detect and mitigate CVE-2021-37682 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →