CyberRota Analysis
AI-GeneratedThe vulnerability affects the Open Neural Network Exchange (ONNX) versions prior to 1.22.0, specifically in the `convert_version()` function, which can lead to a null pointer dereference when processing untrusted models with an Upsample node lacking inputs. This flaw results in an unrecoverable denial of service, potentially disrupting services that rely on ONNX for machine learning interoperability. Organizations utilizing ONNX versions 1.9.0 to 1.21.0 should prioritize upgrading to version 1.22.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)