Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/tvm
main @ 5a8dae4
44
Fixes
9
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Denial of Service: 32 prior fixes. Scrutinize any change in this area.
Relay: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Recursive AST traversal on deeply nested structures like LetNode repeatedly triggered stack overflows. The fix pattern requires transitioning compilers and printers to iterative, non-recursive traversal schemes (such as ExpandANormalForm).
Memory Corruption: Unbounded and unchecked memory copy operations (std::memcpy) inside the Hexagon RPC server IO handler present severe remote memory corruption risks.
Memory Corruption: Managing executable lifetimes via raw pointers in the VirtualMachine led to premature deallocation and use-after-free vulnerabilities during model load and execution.