Security: Add bounds validation for tensor indices in MarkAllocationLifetimes (CVE-2020-15211)

[arunmanni-ai]

Description:

This issue tracks a security fix for CVE-2020-15211, which has been unfixed in TFLite Micro since 2020.

Problem

GetEvalTensor() in TFLite Micro directly indexes tensors[] with attacker-controlled values from the model flatbuffer with no upper bound check. This was fixed in tensorflow/lite/core/subgraph.cc via CVE-2020-15211, but the equivalent fix was never backported to TFLM.

Solution

Add bounds validation for tensor indices read from the model (inputs, outputs, and subgraph references) in MarkAllocationLifetimes(), mirroring the fix already present in tensorflow/lite/core/subgraph.cc.

Return kTfLiteError on violation with descriptive error messages.

Related PR

• PR: fix: validate tensor indices against subgraph bounds in MarkAllocationLifetimes #3591 — fix: validate tensor indices against subgraph bounds in MarkAllocationLifetimes
• Google VRP Issue: [521142176]
• CVE: CVE-2020-15211

Status

PR ready for review.

[github-actions]

This issue is being marked as stale due to inactivity. Remove the stale label or comment to prevent closure in 5 days.

[arunmanni-ai]

Hi there, waiting for PR review