Vulnerability Description
When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds of input_shape which allocated from heap buffers.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mindspore | Mindspore | >= 1.0.0, < 1.3.0 |
Related Weaknesses (CWE)
References
- https://gitee.com/mindspore/community/blob/master/security/security_advisory_lisPatchThird Party Advisory
- https://gitee.com/mindspore/community/blob/master/security/security_advisory_lisPatchThird Party Advisory
FAQ
What is CVE-2021-33649?
CVE-2021-33649 is a vulnerability with a CVSS score of 7.5 (HIGH). When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds...
How severe is CVE-2021-33649?
CVE-2021-33649 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-33649?
Check the references section above for vendor advisories and patch information. Affected products include: Mindspore Mindspore.