Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the adapt methods of the Gemm_7_6 and Gemm_6_7 version converter adapters. These functions are responsible for downgrading or upgrading the Gemm operator between opset versions 7 and 6. The vulnerability occurs because the code directly accesses elements of the input tensor shapes (A_shape and B_shape) without first verifying that the tensors have a sufficient number of dimensions (rank). Specifically, the code accesses A_shape[0], A_shape[1], B_shape[0], and B_shape[1]. If a malicious or malformed model provides a Gemm node with input tensors of rank less than 2, these accesses will read out of bounds from the underlying std::vector storing the shape dimensions. This leads to a heap-buffer-overflow read. The patch for this vulnerability, found in commit cc81c3d36ae0306a49d51c52f227a10d8bb39f80, adds assertions to ensure that both input tensors A and B have a rank of at least 2 before their shapes are accessed. The vulnerable functions are onnx::version_conversion::Gemm_7_6::adapt and onnx::version_conversion::Gemm_6_7::adapt.
onnx::version_conversion::Gemm_7_6::adaptonnx/version_converter/adapters/gemm_7_6.h
onnx::version_conversion::Gemm_6_7::adaptonnx/version_converter/adapters/gemm_6_7.h
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| onnx | pip | >= 1.3.0, <= 1.21.0 | 1.22.0 |