# MSSA-2021-006 - Security Advisory

## Published Date

2021-10-18

## Last Modified Date

2021-10-25

## Impact

When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds of input_shape which allocated from heap buffers.

## Patch

We have fixed this issue in version 1.3.0 through commit [5aab6599e7280d2512a87434c174f13a0a2e7008](https://gitee.com/mindspore/mindspore/commit/5aab6599e7280d2512a87434c174f13a0a2e7008), and created a [patch](https://gitee.com/mindspore/community/blob/master/security/cve_patch/mssa-2021-005.patch) for this vulnerability.

## CVE

To be updated.

## Attribution

This vulnerability has been reported by Wang Xuan(@May) of Qihoo 360 AIVul Team.
