Impact When running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault.

ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types.

Patches We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Under certain conditions, Go code can trigger a segfault in string deallocation.

For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).

To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.

Patches We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22 (merging #50508).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via a fixing PR.

Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0:

python import tensorflow as tf

tf.rawops.NonMaxSuppressionV5( boxes=[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]], scores=[1.0,2.0,3.0], maxoutputsize=-1, iouthreshold=0.5, scorethreshold=0.5, softnmssigma=1.0, padtomaxoutputsize=True) The implementation uses a user controlled argument to resize a std::vector:

cc const int outputsize = maxoutputsize.scalar<int>()(); // ... std::vector<int> selected; // ... if (padtomaxoutputsize) { selected.resize(outputsize, 0); // ... } However, as std::vector::resize takes the size argument as a sizet and outputsize is an int, there is an implicit conversion to usigned. If the attacker supplies a negative value, this conversion results in a crash.

A similar issue occurs in CombinedNonMaxSuppression:

python import tensorflow as tf

tf.rawops.NonMaxSuppressionV5( boxes=[[[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]]]], scores=[[[1.0,2.0,3.0],[1.0,2.0,3.0],[1.0,2.0,3.0]]], maxoutputsizeperclass=-1, maxtotalsize=10, iouthreshold=scorethreshold=0.5, padperclass=True, clipboxes=True) Patches We have patched the issue in GitHub commit 3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d and commit b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage:

python import tensorflow as tf tf.rawops.MapStage( key=tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64), indices=tf.constant((0), dtype=tf.int32), values=[tf.constant((0), dtype=tf.int32)], dtypes=[tf.int32, tf.int64], capacity=0, memorylimit=0, container='', sharedname='') The implementation does not check that the key input is a valid non-empty tensor. Patches We have patched the issue in GitHub commit d7de67733925de196ec8863a33445b73f9562d1d.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact An attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation:

python import tensorflow as tf tf.rawops.MaxPoolGrad( originput = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), origoutput = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), grad = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), ksize = [1, 16, 16, 1], strides = [1, 16, 18, 1], padding = "EXPLICIT", explicitpaddings = [0, 0, 14, 3, 15, 5, 0, 0]) The implementation misses some validation for the originput and origoutput tensors.

The fixes for CVE-2021-29579 were incomplete. Patches We have patched the issue in GitHub commit 136b51f10903e044308cf77117c0ed9871350475.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The shape inference code for tf.rawops.Dequantize has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments:

python import tensorflow as tf

tf.compat.v1.disablev2behavior() tf.rawops.Dequantize( inputtensor = tf.constant(-10.0, dtype=tf.float32), inputtensor = tf.cast(inputtensor, dtype=tf.quint8), minrange = tf.constant([], shape=[0], dtype=tf.float32), maxrange = tf.constant([], shape=[0], dtype=tf.float32), mode = 'MINCOMBINED', narrowrange=False, axis=-10, dtype=tf.dtypes.float32)

The shape inference implementation uses axis to select between two different values for minmaxrank which is then used to retrieve tensor dimensions. However, code assumes that axis can be either -1 or a value greater than -1, with no validation for the other values.

Patches We have patched the issue in GitHub commit da857cfa0fde8f79ad0afdbc94e88b5d4bbec764.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The implementation of division in TFLite is vulnerable to a division by 0 error

There is no check that the divisor tensor does not contain zero elements.

Patches We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.

Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause denial of service in applications serving models using tf.rawops.UnravelIndex by triggering a division by 0:

python import tensorflow as tf

tf.rawops.UnravelIndex(indices=-1, dims=[1,0,2]) The implementation does not check that the tensor subsumed by dims is not empty. Hence, if one element of dims is 0, the implementation does a division by 0.

Patches We have patched the issue in GitHub commit a776040a5e7ebf76eeb7eb923bf1ae417dd4d233.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.UpperBound:

python import tensorflow as tf tf.rawops.UpperBound( sortedinput=[1,2,3], values=tf.constant(value=[[0,0,0],[1,1,1],[2,2,2]],dtype=tf.int64), outtype=tf.int64) The implementation does not validate the rank of sortedinput argument:

cc void Compute(OpKernelContext ctx) override { const Tensor& sortedinputst = ctx->input(0); // ... OPREQUIRES(ctx, sortedinputst.dimsize(0) == valuest.dimsize(0), Status(error::INVALIDARGUMENT, "Leading dimsize of both tensors must match.")); // ... if (outputt->dtype() == DTINT32) { OPREQUIRES(ctx, FastBoundsCheck(sortedinputst.dimsize(1), ...)); // ... }

As we access the first two dimensions of sortedinputst tensor, it must have rank at least 2.

A similar issue occurs in tf.rawops.LowerBound.

Patches We have patched the issue in GitHub commit 42459e4273c2e47a3232cc16c4f4fff3b3a35c38. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation.

cc int RunningSignBit(const TfLiteTensor input, const TfLiteTensor weight, float seed) { int inputitembytes = input->bytes / SizeOfDimension(input, 0); // ... } There is no check that the first dimension of the input is non zero. Patches We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2:

python import tensorflow as tf tf.rawops.SdcaOptimizerV2( sparseexampleindices=[[1]], sparsefeatureindices=[[1]], sparsefeaturevalues=[[1.0,2.0]], densefeatures=[[1.0]], exampleweights=[1.0], examplelabels=[], sparseindices=[1], sparseweights=[1.0], denseweights=[[1.0]], examplestatedata=[[100.0,100.0,100.0,100.0]], losstype='logisticloss', l1=100.0, l2=100.0, numlosspartitions=1, numinneriterations=1, adaptive=True)

The implementation does not check that the length of examplelabels is the same as the number of examples.

Patches We have patched the issue in GitHub commit a4e138660270e7599793fa438cd7b2fc2ce215a6.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation.

Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices.

Similar issue exists in Gather implementation.

python import tensorflow as tf import numpy as np tf.compat.v1.disablev2behavior()

params = tf.compat.v1.placeholder(name="params", dtype=tf.int64, shape=(1,)) indices = tf.compat.v1.placeholder(name="indices", dtype=tf.int64, shape=())

out = tf.gather(params, indices, name='out')

with tf.compat.v1.Session() as sess: converter = tf.compat.v1.lite.TFLiteConverter.fromsession(sess, [params, indices], [out]) tflitemodel = converter.convert()

interpreter = tf.lite.Interpreter(modelcontent=tflitemodel) interpreter.allocatetensors()

inputdetails = interpreter.getinputdetails() outputdetails = interpreter.getoutputdetails()

paramsdata = np.reshape(np.array([1], dtype=np.int64), newshape=(1,)) indicesdata = np.reshape(np.array(-10, dtype=np.int64), newshape=()) interpreter.settensor(inputdetails[0]['index'], paramsdata) interpreter.settensor(inputdetails[1]['index'], indicesdata)

interpreter.invoke()

Patches We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

cc if (axis < 0) { axis = inputdims.size + 1 + axis; } TFLITEENSURE(context, axis <= inputdims.size);

TfLiteIntArray outputdims = TfLiteIntArrayCreate(inputdims.size + 1); for (int i = 0; i < outputdims->size; ++i) { if (i < axis) { outputdims->data[i] = inputdims.data[i]; } else if (i == axis) { outputdims->data[i] = 1; } else { outputdims->data[i] = inputdims.data[i - 1]; } }

If axis is a large negative value (e.g., -100000), then after the first if it would still be negative. The check following the if statement will pass and the for loop would read one element before the start of inputdims.data (when i = 0).

Patches We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition:

cc for (int i = 0; i < effectivedims;) { if ((1 << i) & opcontext->params->ellipsismask) { // ... int ellipsisendidx = std::min(i + 1 + numaddaxis + opcontext->inputdims - begincount, effectivedims); // ... for (; i < ellipsisendidx; ++i) { // ... } continue; } // ... ++i; }

An attacker can craft a model such that ellipsisendidx is smaller than i (e.g., always negative). In this case, the inner loop does not increase i and the continue statement causes execution to skip over the preincrement at the end of the outer loop.

Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.

The fix will be included in TensorFlow 2.6.0. This is the only affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of fully connected layers in TFLite is vulnerable to a division by zero error:

cc const int batchsize = inputsize / filter->dims->data[1];

An attacker can craft a model such that filter->dims->data[1] is 0.

Patches We have patched the issue in GitHub commit 718721986aa137691ee23f03638867151f74935f.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.

Impact Most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash:

python import tensorflow as tf

tf.compat.v1.disablev2behavior() tf.rawops.Conv2D( input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32), filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32), strides = [1, 1, 1, 1], padding = "SAME")

The shape inference implementation is missing several validations before doing divisions and modulo operations.

Patches We have patched the issue in GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The implementation of tf.rawops.StringNGrams is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

python import tensorflow as tf

tf.rawops.StringNGrams( data=['',''], datasplits=[0,2], separator=' '100, ngramwidths=[-80,0,0,-60], leftpad=' ', rightpad=' ', padwidth=100, preserveshortsequences=False)

The implementation calls reserve on a tstring with a value that sometimes can be negative if user supplies negative ngramwidths. The reserve method calls TFTStringReserve which has an unsigned long argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer.

Patches We have patched the issue in GitHub commit c283e542a3f422420cfdb332414543b62fc4e4a5.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments:

python import tensorflow as tf from tensorflow.python.ops import genboostedtreesops import numpy as np

v= tf.Variable([0.0, 0.0, 0.0, 0.0, 0.0]) genboostedtreesops.boostedtreescreatequantilestreamresource( quantilestreamresourcehandle = v.handle, epsilon = [74.82224], numstreams = [-49], maxelements = np.int32(586))

The implementation does not validate that numstreams only contains non-negative numbers. In turn, this results in using this value to allocate memory:

cc class BoostedTreesQuantileStreamResource : public ResourceBase { public: BoostedTreesQuantileStreamResource(const float epsilon, const int64 maxelements, const int64 numstreams) : arebucketsready(false), epsilon(epsilon), numstreams(numstreams), maxelements(maxelements) { streams.reserve(numstreams); ... } }

However, reserve receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library.

Patches We have patched the issue in GitHub commit 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

python import tensorflow as tf

tf.rawops.QuantizeAndDequantizeV4Grad( gradients=[1.0,2.0], input=[1.0,1.0], inputmin=[0.0], inputmax=[10.0], axis=-100)

The implementation uses the axis value as the size argument to absl::InlinedVector constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer.

Patches We have patched the issue in GitHub commit 96f364a1ca3009f98980021c4b32be5fdcca33a1.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, and TensorFlow 2.4.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Providing a negative element to numelements list argument of tf.rawops.TensorListReserve causes the runtime to abort the process due to reallocating a std::vector to have a negative number of elements:

python import tensorflow as tf

tf.rawops.TensorListReserve( elementshape = tf.constant([1]), numelements=tf.constant([-1]), elementdtype = tf.int32)

The implementation calls std::vector.resize() with the new size controlled by input given by the user, without checking that this input is valid.

Patches We have patched the issue in GitHub commit 8a6e874437670045e6c7dc6154c7412b4a2135e2.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

python import tensorflow as tf

tf.rawops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1])

The implementation has a logic error: it should skip processing if x and v are empty but the code uses || instead of &&.

Patches We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger a crash via a floating point exception in tf.rawops.ResourceGather:

python import tensorflow as tf

tensor = tf.constant(value=[[]],shape=(0,1),dtype=tf.uint32) v = tf.Variable(tensor) tf.rawops.ResourceGather( resource=v.handle, indices=[0], dtype=tf.uint32, batchdims=1, validateindices=False)

The implementation computes the value of a value, batchsize, and then divides by it without checking that this value is not 0.

Patches We have patched the issue in GitHub commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of tf.rawops.ResourceScatterDiv is vulnerable to a division by 0 error:

python import tensorflow as tf

v= tf.Variable([1,2,3]) tf.rawops.ResourceScatterDiv( resource=v.handle, indices=[1], updates=[0])

The implementation uses a common class for all binary operations but fails to treat the division by 0 case separately.

Patches We have patched the issue in GitHub commit 4aacb30888638da75023e6601149415b39763d76.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of tf.rawops.SparseReshape can be made to trigger an integral division by 0 exception:

python import tensorflow as tf

tf.rawops.SparseReshape( inputindices = np.ones((1,3)), inputshape = np.array([1,1,0]), newshape = np.array([1,0])) The implementation calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements.

The reshape functor blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. Patches We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of tf.rawops.SparseDenseCwiseDiv is vulnerable to a division by 0 error:

python import tensorflow as tf import numpy as np

tf.rawops.SparseDenseCwiseDiv( spindices=np.array([[4]]), spvalues=np.array([-400]), spshape=np.array([647.]), dense=np.array([0]))

The implementation uses a common class for all binary operations but fails to treat the division by 0 case separately.

Patches We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact In TensorFlow Lite models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very large value to trigger a large allocation: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segmentsum.cc#L39-L44

Patches We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

Workarounds A potential workaround would be to add a custom Verifier to limit the maximum value in the segment ids tensor. This only handles the case when the segment ids are stored statically in the model, but a similar validation could be done if the segment ids are generated at runtime, between inference steps.

However, if the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been discovered from a variant analysis of GHSA-p2cq-cprg-frvm.