CVE-2021-37687

CVE-2021-37687 describes a heap-based out-of-bounds read in TensorFlow Lite’s GatherNd and Gather, caused by missing index checks for negative values in indices. An attacker could read arbitrary heap data via crafted models. Patched in GitHub commits bb6a0383ed... and eb92112211..., with the fix ...

CVE-2021-37687 Heap OOB in TensorFlow Lite's `Gather*` implementations

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with...