TensorFlow is an end-to-end open source platform for machine learning. If the splits
argument of RaggedBincount
does not specify a valid SparseTensor
(https://www.tensorflow.org/apidocs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the splits
tensor buffer in the implementation of the RaggedBincount
op(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincountop.cc#L430-L433). Before the for
loop, batch_idx
is set to 0. The user controls the splits
array, making it contain only one element, 0. Thus, the code in the while
loop would increment batch_idx
and then try to read splits(1)
, which is outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected.