Segmentation fault in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

输入验证不恰当

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 tensorflow-lite 1.15.4之前版本, 2.0.3版本, 2.1.2版本, 2.2.1版本，2.3.1版本中存在缓冲区错误漏洞，该漏洞允许攻击者观察到分段错误或仅内存损坏。

N/A

N/A