TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal poolingratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.
Impact TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.
python from tensorflow.keras import models
payload = ''' !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "import('os').system('cat /etc/passwd')" ''' models.modelfromyaml(payload) The implementation uses yaml.unsafeload which can perform arbitrary code execution on the input.
Patches Given that YAML format support requires a significant amount of work, we have removed it for now.
We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Arjun Shibu.
TensorFlow is an open source platform for machine learning. When the BaseCandidateSamplerOp function receives a value in trueclasses larger than rangemax, a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Impact In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/referenceops.h#L2625-L2631
Users having access to segmentidsdata can alter outputindex and then write to outside of outputdata buffer.
This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits.
Patches We have patched the issue in 204945b and will release patch releases for all affected versions.
We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.
Workarounds A potential workaround would be to add a custom Verifier to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored statically in the model.
A similar validation could be done if the segment ids are generated at runtime between inference steps.
If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been discovered from a variant analysis of GHSA-p2cq-cprg-frvm.
Impact When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer:
python import tensorflow as tf
tf.rawops.Restore( filepattern=['/tmp'], tensorname=[], defaultvalue=21, dt=tf.int, preferredshard=1) The same undefined behavior can be triggered by tf.rawops.RestoreSlice: python import tensorflow as tf
tf.rawops.RestoreSlice( filepattern=['/tmp'], tensorname=[], shapeandslice='2', dt=inp.array([tf.int]), preferredshard=1)
Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration:
python import tensorflow as tf
tf.rawops.Restore( filepattern=['/tmp'], tensorname=['x'], defaultvalue=21, dt=tf.int, preferredshard=42) The implementation retrieves the tensor list corresponding to the tensorname user controlled input and immediately retrieves the tensor at the restoration index (controlled via preferredshard argument). This occurs without validating that the provided list has enough values.
If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read.
Patches We have patched the issue in GitHub commit 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact In TensorFlow Lite models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segmentsum.cc#L39-L44
This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/referenceops.h#L2625-L2631
This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits.
Patches We have patched the issue in 204945b and will release patch releases for all affected versions.
We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.
Workarounds A potential workaround would be to add a custom Verifier to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model.
A similar validation could be done if the segment ids are generated at runtime between inference steps.
If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
TensorFlow is an open source platform for machine learning. The reference kernel of the CONV3DTRANSPOSE TensorFlow Lite operator wrongly increments the dataptr when adding the bias to the result. Instead of dataptr += numchannels; it should be dataptr += outputnumchannels; as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if numchannels > outputnumchannels. An attacker can craft a model with a specific number of input channels. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter. We have patched the issue in GitHub commit 72c0bdcb25305b0b36842d746cc61d72658d2941. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
python import tensorflow as tf
model = tf.keras.models.Sequential() model.add(tf.keras.Input(shape=(1, 2, 3))) model.add(tf.keras.layers.Dense(0, activation='relu'))
converter = tf.lite.TFLiteConverter.fromkerasmodel(model) tflitemodel = converter.convert()
interpreter = tf.lite.Interpreter(modelcontent=tflitemodel) interpreter.allocatetensors()
interpreter.invoke()
The implementation unconditionally dereferences a pointer.
cc if (y4 > 1) { // ... } else { for (int i0 = 0; i0 < y0; ++i0) { const T input2dataptr = nullptr; for (int i1 = 0; i1 < y1; ++i1) { input2dataptr = input2datareset; for (int i2 = 0; i2 < y2; ++i2) { scalarbroadcastf(y3, params, input1dataptr, input2dataptr, outputdataptr); } } } }
Patches We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Impact The implementation for tf.rawops.FractionalAvgPoolGrad can be tricked into accessing data outside of bounds of heap allocated buffers:
python import tensorflow as tf
tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[0,1,2,3], outbackprop = np.array([[[[541],[541]],[[541],[541]]]]), rowpoolingsequence=[0, 0, 0, 0, 0], colpoolingsequence=[-2, 0, 0, 2, 0], overlapping=True)
The implementation does not validate that the input tensor is non-empty. Thus, code constructs an empty EigenDoubleMatrixMap and then accesses this buffer with indices that are outside of the empty area.
Patches We have patched the issue in GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Due to incomplete validation in tf.rawops.QuantizeV2, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:
python import tensorflow as tf
tf.rawops.QuantizeV2( input=[1,2,3], minrange=[1,2], maxrange=[], T=tf.qint32, mode='SCALED', roundmode='HALFAWAYFROMZERO', narrowrange=False, axis=1, ensureminimumrange=3)
The implementation has some validation but does not check that minrange and maxrange both have the same non-zero number of elements. If axis is provided (i.e., not -1), then validation should check that it is a value in range for the rank of input tensor and then the lengths of minrange and maxrange inputs match the axis dimension of the input tensor. Patches We have patched the issue in GitHub commit 6da6620efad397c85493b8f8667b821403516708. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows:
python import tensorflow as tf tf.compat.v1.disablev2behavior() tf.rawops.SparseFillEmptyRows( indices = tf.constant([], shape=[0, 0], dtype=tf.int64), values = tf.constant([], shape=[0], dtype=tf.int64), denseshape = tf.constant([], shape=[0], dtype=tf.int64), defaultvalue = 0) The shape inference implementation does not validate that the input arguments are not empty tensors.
Patches We have patched the issue in GitHub commit 578e634b4f1c1c684d4b4294f9e5281b2133b3ed.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security
Impact The implementation for tf.rawops.ExperimentalDatasetToTFRecord and tf.rawops.DatasetToTFRecord can trigger heap buffer overflow and segmentation fault:
python import tensorflow as tf
dataset = tf.data.Dataset.range(3) dataset = tf.data.experimental.tovariant(dataset) tf.rawops.ExperimentalDatasetToTFRecord( inputdataset=dataset, filename='/tmp/output', compressiontype='')
The implementation assumes that all records in the dataset are of string type. However, there is no check for that, and the example given above uses numeric types.
Patches We have patched the issue in GitHub commit e0b6e58c328059829c3eb968136f17aa72b6c876.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:
python import tensorflow as tf
tf.rawops.RequantizationRangePerChannel( input=[], inputmin=[0,0,0,0,0], inputmax=[1,1,1,1,1], clipvaluemax=1) The implementation does not validate the dimensions of the input tensor.
A similar issue occurs in MklRequantizePerChannelOp:
python import tensorflow as tf from tensorflow.python.ops import genmathops
genmathops.requantizeperchannel( input=[], inputmin=[-100,-100,-100,-100,-100], inputmax=[-100,-100,-100], requestedoutputmin=[-100,-100,-100,-100,-100], requestedoutputmax=[], outtype=tf.int)
The implementation does not perform full validation for all the input arguments.
Patches We have patched the issue in GitHub commit 9e62869465573cb2d9b5053f1fa02a81fce21d69 and in the Github commit 203214568f5bc237603dbab6e1fd389f1572f5c9.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The implementation of SVDF in TFLite is vulnerable to a null pointer error:
cc TfLiteTensor state = GetVariableInput(context, node, kStateTensor); // ... GetTensorData<float>(state)
The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.
cc TfLiteTensor GetVariableInput(TfLiteContext context, const TfLiteNode node, int index) { TfLiteTensor tensor = GetMutableInput(context, node, index); return tensor->isvariable ? tensor : nullptr; }
Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->isvariable expression can also trigger a null pointer exception.
Patches We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:
cc bool L2NormalizeReduceAxis(Value sqop, DenseElementsAttr axis) { if (sqop.getType().cast<ShapedType>().getRank() - 1 == axis.getValues<int>().begin() || axis.getValues<int>().begin() == -1) { // ... } // ... }
Patches We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.UnicodeEncode:
python import tensorflow as tf from tensorflow.python.ops import genstringops
genstringops.unicodeencode( inputvalues=[], inputsplits=[], outputencoding='UTF-8', errors='ignore', replacementchar='a')
The implementation reads the first dimension of the inputsplits tensor before validating that this tensor is not empty:
cc const Tensor& inputsplits = context->input(1); const auto inputsplitsflat = inputsplits.flat<SPLITSTYPE>(); TensorShape outputshape({inputsplits.dimsize(0) - 1});
Patches We have patched the issue in GitHub commit 2e0ee46f1a47675152d3d865797a18358881d7a6.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:
python import tensorflow as tf x = tf.ragged.constant([[1,2,3], [4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x) z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]]) The t and z outputs should be identical, however this is not the case. The last row of t contains data from the heap which can be used to leak other memory information.
The bug lies in the conversion from a Variant tensor to a RaggedTensor. The implementation does not check that all inner shapes match and this results in the additional dimensions in the above example.
The same implementation can result in data loss, if input tensor is tweaked:
python import tensorflow as tf x = tf.ragged.constant([[1,2], [3,4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x)
Here, the output tensor will only have 2 elements for each inner dimension.
Patches We have patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Haris Sahovic.
Impact The code for tf.rawops.SaveV2 does not properly validate the inputs and an attacker can trigger a null pointer dereference:
python import tensorflow as tf
tf.rawops.SaveV2( prefix=['tensorflow'], tensorname=['v'], shapeandslices=[], tensors=[1,2,3]) The implementation uses ValidateInputs to check that the input arguments are valid. This validation would have caught the illegal state represented by the reproducer above.
However, the validation uses OPREQUIRES which translates to setting the Status object of the current OpKernelContext to an error status, followed by an empty return statement which just terminates the execution of the function it is present in. However, this does not mean that the kernel execution is finalized: instead, execution continues from the next line in Compute that follows the call to ValidateInputs. This is equivalent to lacking the validation. Patches We have patched the issue in GitHub commit 9728c60e136912a12d99ca56e106b7cce7af5986.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant:
python import tensorflow as tf
tf.rawops.RaggedTensorToVariant( rtnestedsplits=[], rtdensevalues=[1,2,3], batchedinput=True) The implementation has an incomplete validation of the splits values, missing the case when the argument would be empty.
Patches We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixSetDiagV:
python import tensorflow as tf
tf.rawops.MatrixSetDiagV3( input=[1,2,3], diagonal=[1,1], k=[], align='RIGHTLEFT') The implementation has incomplete validation that the value of k is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong:
cc auto& diagindex = context->input(1); ... lowerdiagindex = diagindex.flat<int32>()(0); Patches We have patched the issue in GitHub commit ff8894044dfae5568ecbf2ed514c1a37dc394f1b.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations):
python import tensorflow as tf
tf.rawops.SqrtGrad(y=[4, 16],dy=[]) The implementation assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr.
Patches We have patched the issue in GitHub commit 93f428fd1768df147171ed674fee1fc5ab8309ec.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations:
python import tensorflow as tf tf.rawops.MapPeek( key=tf.constant([8],dtype=tf.int64), indices=[], dtypes=[tf.int32], capacity=8, memorylimit=128)
The implementation has a check in place to ensure that indices is in ascending order, but does not check that indices is not empty. Patches We have patched the issue in GitHub commit 532f5c5a547126c634fefd43bbad1dc6417678ac. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can generate undefined behavior via a reference binding to nullptr in BoostedTreesCalculateBestGainsPerFeature:
python import tensorflow as tf
tf.rawops.BoostedTreesCalculateBestGainsPerFeature( nodeidrange=[], statssummarylist=[[1,2,3]], l1=[1.0], l2=[1.0], treecomplexity =[1.0], minnodeweight =[1.17], maxsplits=5)
A similar attack can occur in BoostedTreesCalculateBestFeatureSplitV2:
python import tensorflow as tf tf.rawops.BoostedTreesCalculateBestFeatureSplitV2( nodeidrange=[], statssummarieslist=[[1,2,3]], splittypes=[''], candidatefeatureids=[1,2,3,4], l1=[1], l2=[1], treecomplexity=[1.0], minnodeweight=[1.17], logitsdimension=5) The implementation does not validate the input values.
Patches We have patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit. 429f009d2b2c09028647dd4bb7b3f6f414bbaad7.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToSparse:
python import tensorflow as tf
tf.rawops.RaggedTensorToSparse( rtnestedsplits=[[0, 38, 0]], rtdensevalues=[]) The implementation has an incomplete validation of the splits values: it does not check that they are in increasing order.
Patches We have patched the issue in GitHub commit 1071f554dbd09f7e101324d366eec5f4fe5a3ece.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Sending invalid argument for rowpartitiontypes of tf.rawops.RaggedTensorToTensor API results in a null pointer dereference and undefined behavior:
python import tensorflow as tf
tf.rawops.RaggedTensorToTensor( shape=1, values=10, defaultvalue=21, rowpartitiontensors=tf.constant([0,0,0,0]), rowpartitiontypes=[])
The implementation accesses the first element of a user supplied list of values without validating that the provided list is not empty.
Patches We have patched the issue in GitHub commit 301ae88b331d37a2a16159b65b255f4f9eb39314.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixDiagV:
python import tensorflow as tf
tf.rawops.MatrixDiagV3( diagonal=[1,0], k=[], numrows=[1,2,3], numcols=[4,5], paddingvalue=[], align='RIGHTRIGHT')
The implementation has incomplete validation that the value of k is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong:
cc auto& diagindex = context->input(1); ... lowerdiagindex = diagindex.flat<int32>()(0);
Patches We have patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The implementation for tf.rawops.BoostedTreesCreateEnsemble can result in a use after free error if an attacker supplies specially crafted arguments:
python import tensorflow as tf
v= tf.Variable([0.0]) tf.rawops.BoostedTreesCreateEnsemble( treeensemblehandle=v.handle, stamptoken=[0], treeensembleserialized=['0'])
The implementation uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent free-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed.
Patches We have patched the issue in GitHub commit 5ecec9c6fbdbc6be03295685190a45e7eee726ab.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact If a user does not provide a valid padding value to tf.rawops.MatrixDiagPartOp, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first:
python import tensorflow as tf
tf.rawops.MatrixDiagPartV2( input=tf.ones(2,dtype=tf.int32), k=tf.ones(2,dtype=tf.int32), paddingvalue=[])
Although this example is given for MatrixDiagPartV2, all versions of the operation are affected.
The implementation reads the first value from a tensor buffer without first checking that the tensor has values to read from.
Patches We have patched the issue in GitHub commit 482da92095c4d48f8784b1f00dda4f81c28d2988.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference:
python import tensorflow as tf
data = tf.data.Dataset.fromtensors([0.0]) tf.rawops.UncompressElement( compressed=tf.data.experimental.tovariant(data), outputtypes=[tf.int64], outputshapes=[2]) The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressing. There is no check that the Variant tensor contained a CompressedElement, so the pointer is actually nullptr.
Patches We have patched the issue in GitHub commit 7bdf50bb4f5c54a4997c379092888546c97c3ebd.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement:
python import tensorflow as tf
tf.rawops.CompressElement(components=[[]]) The implementation was accessing the size of a buffer obtained from the return of a separate function call before validating that said buffer is valid.
Patches We have patched the issue in GitHub commit 5dc7f6981fdaf74c8c5be41f393df705841fb7c5.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it was resolved in master branch as it was also discovered internally and fixed before the report was handled.