tensorflow is vulnerable to denial of service. The vulnerability exists because the SetOpAttrList
function of pywrap_tfe_src.cc
fails to parse the tensor and returns a nullptr
without proper error handling, allowing an attacker to cause an application crash through the null pointer dereference
github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc
github.com/tensorflow/tensorflow/commit/2011ec0e0cc6989a6b2b617e32b2e3f1cd7b9624
github.com/tensorflow/tensorflow/commit/306e17fead7ea08d2e551bd0e1e0c77e622fc575
github.com/tensorflow/tensorflow/commit/4203c7999a33ee8ca19af4b6096d0fa413c93dca
github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce
github.com/tensorflow/tensorflow/pull/57864
github.com/tensorflow/tensorflow/pull/57865
github.com/tensorflow/tensorflow/pull/57866
github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g