CVE-2020-15209: TensorFlow Lite: null ptr deref crashes model inference

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Adversary crafts a malicious .tflite model file by modifying the flatbuffer serialization to remap a tensor's buffer index from read-only to read-write—pointing to a nullptr-initialized buffer that is never written before read. The adversary distributes this file via a public model hub (e.g., TensorFlow Hub if unverified), a supply chain compromise of an ML pipeline artifact store, or via social engineering (e.g., sending a 'benchmark model' to a target MLOps team). When the target's TFLite runtime loads and executes the model, null pointer dereference triggers, crashing the inference process. In an automated inference API context, repeated delivery of this model causes persistent DoS without any authentication required.