Nixpkgs security tracker
3.3 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0.
References
-
-
https://github.com/onnx/onnx/pull/7880 x_refsource_MISC
-
https://github.com/onnx/onnx/releases/tag/v1.22.0 x_refsource_MISC
Affected products
- ==>= 1.3.0, < 1.22.0
Matching in nixpkgs
pkgs.onnx
Open Neural Network Exchange
pkgs.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.sherpa-onnx
Speech-to-text, text-to-speech, and speaker recognition using next-gen Kaldi with onnxruntime
pkgs.pkgsRocm.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.pkgsRocm.sherpa-onnx
Speech-to-text, text-to-speech, and speaker recognition using next-gen Kaldi with onnxruntime
pkgs.python313Packages.onnx
Open Neural Network Exchange
pkgs.python314Packages.onnx
Open Neural Network Exchange
pkgs.python313Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.python313Packages.tf2onnx
Convert TensorFlow, Keras, Tensorflow.js and Tflite models to ONNX
pkgs.python314Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.python313Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.python313Packages.onnxslim
Toolkit to Help Optimize Onnx Model
pkgs.python313Packages.skl2onnx
Convert scikit-learn models to ONNX
pkgs.python314Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.python314Packages.onnxslim
Toolkit to Help Optimize Onnx Model
pkgs.python314Packages.skl2onnx
Convert scikit-learn models to ONNX
pkgs.python313Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python314Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python313Packages.onnxmltools
ONNXMLTools enables conversion of models to ONNX
pkgs.python313Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.python313Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.python314Packages.onnxmltools
ONNXMLTools enables conversion of models to ONNX
pkgs.python314Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.python314Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.python313Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.python314Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.pkgsRocm.python3Packages.onnx-ir
Efficient in-memory representation for ONNX, in Python
pkgs.pkgsRocm.python3Packages.tf2onnx
None
pkgs.pkgsRocm.python3Packages.onnx-asr
Lightweight Automatic Speech Recognition using ONNX models
pkgs.pkgsRocm.python3Packages.onnxscript
Naturally author ONNX functions and models using a subset of Python
pkgs.python313Packages.onnxruntime-tools
Transformers Model Optimization Tool of ONNXRuntime
pkgs.python314Packages.onnxruntime-tools
Transformers Model Optimization Tool of ONNXRuntime
pkgs.pkgsRocm.python3Packages.onnxruntime
Cross-platform, high performance scoring engine for ML models
pkgs.pkgsRocm.python3Packages.sherpa-onnx
Python bindings for sherpa-onnx speech recognition
pkgs.pkgsRocm.python3Packages.optimum-onnx
Export your model to ONNX and run inference with ONNX Runtime
pkgs.python313Packages.onnxconverter-common
ONNX Converter and Optimization Tools
pkgs.python313Packages.rapidocr-onnxruntime
Cross platform OCR Library based on OnnxRuntime
pkgs.python314Packages.onnxconverter-common
ONNX Converter and Optimization Tools
pkgs.python314Packages.rapidocr-onnxruntime
Cross platform OCR Library based on OnnxRuntime
Package maintainers
-
@ConnorBaker Connor Baker <ConnorBaker01@gmail.com>
-
@acairncross Aiken Cairncross <acairncross@gmail.com>
-
@puffnfresh Brian McKenna <brian@brianmckenna.org>
-
@ck3d Christian Kögler <ck3d@gmx.de>
-
@jaredmontoya Jared Montoya
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@wrvsrx wrvsrx <wrvsrx@outlook.com>
-
@happysalada Raphael Megzari <raphael@megzari.com>