In Tensorflow before version 2.3.1, the RaggedCountSparseOutput
implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits
tensor generate a valid partitioning of the values
tensor. Hence, the code is prone to heap buffer overflow. If split_values
does not end with a value at least num_values
then the while
loop condition will trigger a read outside of the bounds of split_values
once batch_idx
grows too large. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
{ "cpes": [ "cpe:2.3:a:google:tensorflow:2.3.0:*:*:*:-:*:*:*", "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*" ], "severity": "Medium" }