the-algorithm-ml icon indicating copy to clipboard operation
the-algorithm-ml copied to clipboard

Patch: TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

Open alwell-kevin opened this issue 1 year ago • 1 comments

Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE. When axis is larger than the dim of input, c->Dim(input,axis) goes out of bound. Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad operations too.

alwell-kevin avatar Apr 03 '23 17:04 alwell-kevin

CLA assistant check
All committers have signed the CLA.

CLAassistant avatar Apr 03 '23 17:04 CLAassistant