Impact TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.
python from tensorflow.keras import models
payload = ''' !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "import('os').system('cat /etc/passwd')" ''' models.modelfromyaml(payload) The implementation uses yaml.unsafeload which can perform arbitrary code execution on the input.
Patches Given that YAML format support requires a significant amount of work, we have removed it for now.
We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Arjun Shibu.
Impact When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer:
python import tensorflow as tf
tf.rawops.Restore( filepattern=['/tmp'], tensorname=[], defaultvalue=21, dt=tf.int, preferredshard=1) The same undefined behavior can be triggered by tf.rawops.RestoreSlice: python import tensorflow as tf
tf.rawops.RestoreSlice( filepattern=['/tmp'], tensorname=[], shapeandslice='2', dt=inp.array([tf.int]), preferredshard=1)
Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration:
python import tensorflow as tf
tf.rawops.Restore( filepattern=['/tmp'], tensorname=['x'], defaultvalue=21, dt=tf.int, preferredshard=42) The implementation retrieves the tensor list corresponding to the tensorname user controlled input and immediately retrieves the tensor at the restoration index (controlled via preferredshard argument). This occurs without validating that the provided list has enough values.
If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read.
Patches We have patched the issue in GitHub commit 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
python import tensorflow as tf
model = tf.keras.models.Sequential() model.add(tf.keras.Input(shape=(1, 2, 3))) model.add(tf.keras.layers.Dense(0, activation='relu'))
converter = tf.lite.TFLiteConverter.fromkerasmodel(model) tflitemodel = converter.convert()
interpreter = tf.lite.Interpreter(modelcontent=tflitemodel) interpreter.allocatetensors()
interpreter.invoke()
The implementation unconditionally dereferences a pointer.
cc if (y4 > 1) { // ... } else { for (int i0 = 0; i0 < y0; ++i0) { const T input2dataptr = nullptr; for (int i1 = 0; i1 < y1; ++i1) { input2dataptr = input2datareset; for (int i2 = 0; i2 < y2; ++i2) { scalarbroadcastf(y3, params, input1dataptr, input2dataptr, outputdataptr); } } } }
Patches We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Impact The implementation for tf.rawops.FractionalAvgPoolGrad can be tricked into accessing data outside of bounds of heap allocated buffers:
python import tensorflow as tf
tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[0,1,2,3], outbackprop = np.array([[[[541],[541]],[[541],[541]]]]), rowpoolingsequence=[0, 0, 0, 0, 0], colpoolingsequence=[-2, 0, 0, 2, 0], overlapping=True)
The implementation does not validate that the input tensor is non-empty. Thus, code constructs an empty EigenDoubleMatrixMap and then accesses this buffer with indices that are outside of the empty area.
Patches We have patched the issue in GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Due to incomplete validation in tf.rawops.QuantizeV2, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:
python import tensorflow as tf
tf.rawops.QuantizeV2( input=[1,2,3], minrange=[1,2], maxrange=[], T=tf.qint32, mode='SCALED', roundmode='HALFAWAYFROMZERO', narrowrange=False, axis=1, ensureminimumrange=3)
The implementation has some validation but does not check that minrange and maxrange both have the same non-zero number of elements. If axis is provided (i.e., not -1), then validation should check that it is a value in range for the rank of input tensor and then the lengths of minrange and maxrange inputs match the axis dimension of the input tensor. Patches We have patched the issue in GitHub commit 6da6620efad397c85493b8f8667b821403516708. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows:
python import tensorflow as tf tf.compat.v1.disablev2behavior() tf.rawops.SparseFillEmptyRows( indices = tf.constant([], shape=[0, 0], dtype=tf.int64), values = tf.constant([], shape=[0], dtype=tf.int64), denseshape = tf.constant([], shape=[0], dtype=tf.int64), defaultvalue = 0) The shape inference implementation does not validate that the input arguments are not empty tensors.
Patches We have patched the issue in GitHub commit 578e634b4f1c1c684d4b4294f9e5281b2133b3ed.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security
Impact The implementation for tf.rawops.ExperimentalDatasetToTFRecord and tf.rawops.DatasetToTFRecord can trigger heap buffer overflow and segmentation fault:
python import tensorflow as tf
dataset = tf.data.Dataset.range(3) dataset = tf.data.experimental.tovariant(dataset) tf.rawops.ExperimentalDatasetToTFRecord( inputdataset=dataset, filename='/tmp/output', compressiontype='')
The implementation assumes that all records in the dataset are of string type. However, there is no check for that, and the example given above uses numeric types.
Patches We have patched the issue in GitHub commit e0b6e58c328059829c3eb968136f17aa72b6c876.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:
python import tensorflow as tf
tf.rawops.RequantizationRangePerChannel( input=[], inputmin=[0,0,0,0,0], inputmax=[1,1,1,1,1], clipvaluemax=1) The implementation does not validate the dimensions of the input tensor.
A similar issue occurs in MklRequantizePerChannelOp:
python import tensorflow as tf from tensorflow.python.ops import genmathops
genmathops.requantizeperchannel( input=[], inputmin=[-100,-100,-100,-100,-100], inputmax=[-100,-100,-100], requestedoutputmin=[-100,-100,-100,-100,-100], requestedoutputmax=[], outtype=tf.int)
The implementation does not perform full validation for all the input arguments.
Patches We have patched the issue in GitHub commit 9e62869465573cb2d9b5053f1fa02a81fce21d69 and in the Github commit 203214568f5bc237603dbab6e1fd389f1572f5c9.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The implementation of SVDF in TFLite is vulnerable to a null pointer error:
cc TfLiteTensor state = GetVariableInput(context, node, kStateTensor); // ... GetTensorData<float>(state)
The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.
cc TfLiteTensor GetVariableInput(TfLiteContext context, const TfLiteNode node, int index) { TfLiteTensor tensor = GetMutableInput(context, node, index); return tensor->isvariable ? tensor : nullptr; }
Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->isvariable expression can also trigger a null pointer exception.
Patches We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:
cc bool L2NormalizeReduceAxis(Value sqop, DenseElementsAttr axis) { if (sqop.getType().cast<ShapedType>().getRank() - 1 == axis.getValues<int>().begin() || axis.getValues<int>().begin() == -1) { // ... } // ... }
Patches We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.UnicodeEncode:
python import tensorflow as tf from tensorflow.python.ops import genstringops
genstringops.unicodeencode( inputvalues=[], inputsplits=[], outputencoding='UTF-8', errors='ignore', replacementchar='a')
The implementation reads the first dimension of the inputsplits tensor before validating that this tensor is not empty:
cc const Tensor& inputsplits = context->input(1); const auto inputsplitsflat = inputsplits.flat<SPLITSTYPE>(); TensorShape outputshape({inputsplits.dimsize(0) - 1});
Patches We have patched the issue in GitHub commit 2e0ee46f1a47675152d3d865797a18358881d7a6.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:
python import tensorflow as tf x = tf.ragged.constant([[1,2,3], [4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x) z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]]) The t and z outputs should be identical, however this is not the case. The last row of t contains data from the heap which can be used to leak other memory information.
The bug lies in the conversion from a Variant tensor to a RaggedTensor. The implementation does not check that all inner shapes match and this results in the additional dimensions in the above example.
The same implementation can result in data loss, if input tensor is tweaked:
python import tensorflow as tf x = tf.ragged.constant([[1,2], [3,4,5], [6]]) t = tf.mapfn(lambda r: tf.mapfn(lambda y: r, r), x)
Here, the output tensor will only have 2 elements for each inner dimension.
Patches We have patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Haris Sahovic.
Impact The code for tf.rawops.SaveV2 does not properly validate the inputs and an attacker can trigger a null pointer dereference:
python import tensorflow as tf
tf.rawops.SaveV2( prefix=['tensorflow'], tensorname=['v'], shapeandslices=[], tensors=[1,2,3]) The implementation uses ValidateInputs to check that the input arguments are valid. This validation would have caught the illegal state represented by the reproducer above.
However, the validation uses OPREQUIRES which translates to setting the Status object of the current OpKernelContext to an error status, followed by an empty return statement which just terminates the execution of the function it is present in. However, this does not mean that the kernel execution is finalized: instead, execution continues from the next line in Compute that follows the call to ValidateInputs. This is equivalent to lacking the validation. Patches We have patched the issue in GitHub commit 9728c60e136912a12d99ca56e106b7cce7af5986.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant:
python import tensorflow as tf
tf.rawops.RaggedTensorToVariant( rtnestedsplits=[], rtdensevalues=[1,2,3], batchedinput=True) The implementation has an incomplete validation of the splits values, missing the case when the argument would be empty.
Patches We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixSetDiagV:
python import tensorflow as tf
tf.rawops.MatrixSetDiagV3( input=[1,2,3], diagonal=[1,1], k=[], align='RIGHTLEFT') The implementation has incomplete validation that the value of k is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong:
cc auto& diagindex = context->input(1); ... lowerdiagindex = diagindex.flat<int32>()(0); Patches We have patched the issue in GitHub commit ff8894044dfae5568ecbf2ed514c1a37dc394f1b.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations):
python import tensorflow as tf
tf.rawops.SqrtGrad(y=[4, 16],dy=[]) The implementation assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr.
Patches We have patched the issue in GitHub commit 93f428fd1768df147171ed674fee1fc5ab8309ec.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations:
python import tensorflow as tf tf.rawops.MapPeek( key=tf.constant([8],dtype=tf.int64), indices=[], dtypes=[tf.int32], capacity=8, memorylimit=128)
The implementation has a check in place to ensure that indices is in ascending order, but does not check that indices is not empty. Patches We have patched the issue in GitHub commit 532f5c5a547126c634fefd43bbad1dc6417678ac. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can generate undefined behavior via a reference binding to nullptr in BoostedTreesCalculateBestGainsPerFeature:
python import tensorflow as tf
tf.rawops.BoostedTreesCalculateBestGainsPerFeature( nodeidrange=[], statssummarylist=[[1,2,3]], l1=[1.0], l2=[1.0], treecomplexity =[1.0], minnodeweight =[1.17], maxsplits=5)
A similar attack can occur in BoostedTreesCalculateBestFeatureSplitV2:
python import tensorflow as tf tf.rawops.BoostedTreesCalculateBestFeatureSplitV2( nodeidrange=[], statssummarieslist=[[1,2,3]], splittypes=[''], candidatefeatureids=[1,2,3,4], l1=[1], l2=[1], treecomplexity=[1.0], minnodeweight=[1.17], logitsdimension=5) The implementation does not validate the input values.
Patches We have patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit. 429f009d2b2c09028647dd4bb7b3f6f414bbaad7.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToSparse:
python import tensorflow as tf
tf.rawops.RaggedTensorToSparse( rtnestedsplits=[[0, 38, 0]], rtdensevalues=[]) The implementation has an incomplete validation of the splits values: it does not check that they are in increasing order.
Patches We have patched the issue in GitHub commit 1071f554dbd09f7e101324d366eec5f4fe5a3ece.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact Sending invalid argument for rowpartitiontypes of tf.rawops.RaggedTensorToTensor API results in a null pointer dereference and undefined behavior:
python import tensorflow as tf
tf.rawops.RaggedTensorToTensor( shape=1, values=10, defaultvalue=21, rowpartitiontensors=tf.constant([0,0,0,0]), rowpartitiontypes=[])
The implementation accesses the first element of a user supplied list of values without validating that the provided list is not empty.
Patches We have patched the issue in GitHub commit 301ae88b331d37a2a16159b65b255f4f9eb39314.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixDiagV:
python import tensorflow as tf
tf.rawops.MatrixDiagV3( diagonal=[1,0], k=[], numrows=[1,2,3], numcols=[4,5], paddingvalue=[], align='RIGHTRIGHT')
The implementation has incomplete validation that the value of k is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong:
cc auto& diagindex = context->input(1); ... lowerdiagindex = diagindex.flat<int32>()(0);
Patches We have patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The implementation for tf.rawops.BoostedTreesCreateEnsemble can result in a use after free error if an attacker supplies specially crafted arguments:
python import tensorflow as tf
v= tf.Variable([0.0]) tf.rawops.BoostedTreesCreateEnsemble( treeensemblehandle=v.handle, stamptoken=[0], treeensembleserialized=['0'])
The implementation uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent free-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed.
Patches We have patched the issue in GitHub commit 5ecec9c6fbdbc6be03295685190a45e7eee726ab.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact If a user does not provide a valid padding value to tf.rawops.MatrixDiagPartOp, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first:
python import tensorflow as tf
tf.rawops.MatrixDiagPartV2( input=tf.ones(2,dtype=tf.int32), k=tf.ones(2,dtype=tf.int32), paddingvalue=[])
Although this example is given for MatrixDiagPartV2, all versions of the operation are affected.
The implementation reads the first value from a tensor buffer without first checking that the tensor has values to read from.
Patches We have patched the issue in GitHub commit 482da92095c4d48f8784b1f00dda4f81c28d2988.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference:
python import tensorflow as tf
data = tf.data.Dataset.fromtensors([0.0]) tf.rawops.UncompressElement( compressed=tf.data.experimental.tovariant(data), outputtypes=[tf.int64], outputshapes=[2]) The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressing. There is no check that the Variant tensor contained a CompressedElement, so the pointer is actually nullptr.
Patches We have patched the issue in GitHub commit 7bdf50bb4f5c54a4997c379092888546c97c3ebd.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement:
python import tensorflow as tf
tf.rawops.CompressElement(components=[[]]) The implementation was accessing the size of a buffer obtained from the return of a separate function call before validating that said buffer is valid.
Patches We have patched the issue in GitHub commit 5dc7f6981fdaf74c8c5be41f393df705841fb7c5.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it was resolved in master branch as it was also discovered internally and fixed before the report was handled.
Impact When a user does not supply arguments that determine a valid sparse tensor, tf.rawops.SparseTensorSliceDataset implementation can be made to dereference a null pointer:
python import tensorflow as tf
tf.rawops.SparseTensorSliceDataset( indices=[[],[],[]], values=[1,2,3], denseshape=[3,3]) The implementation has some argument validation but fails to consider the case when either indices or values are provided for an empty sparse tensor when the other is not.
If indices is empty (as in the example above), then code that performs validation (i.e., checking that the indices are monotonically increasing) results in a null pointer dereference:
cc for (int64t i = 0; i < indices->dimsize(0); ++i) { int64t nextbatchindex = indices->matrix<int64>()(i, 0); ... }
If indices as provided by the user is empty, then indices in the C++ code above is backed by an empty std::vector, hence calling indices->dimsize(0) results in null pointer dereferencing (same as calling std::vector::at() on an empty vector).
Patches We have patched the issue in GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact The implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data:
python import tensorflow as tf
x = tf.SparseTensor( indices=[[773, 773, 773], [773, 773, 773]], values=[1, 1], denseshape=[337, 337, 337]) tf.sparse.reducesum(x, 1)
The implementation fails to validate that each reduction group does not overflow and that each corresponding index does not point to outside the bounds of the input tensor.
Patches We have patched the issue in GitHub commit 87158f43f05f2720a374f3e6d22a7aaa3a33f750.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact If the arguments to tf.rawops.RaggedGather don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. python import tensorflow as tf
tf.rawops.RaggedGather( paramsnestedsplits = [0,0,0], paramsdensevalues = [1,1], indices = [0,0,9,0,0], OUTPUTRAGGEDRANK=0)
In debug mode, the same code triggers a CHECK failure.
The implementation directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by paramsnestedsplits is not an empty list of tensors.
Patches We have patched the issue in GitHub commit a2b743f6017d7b97af1fe49087ae15f0ac634373.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit:
python import tensorflow as tf
tf.rawops.BoostedTreesSparseCalculateBestFeatureSplit( nodeidrange=[0,10], statssummaryindices=[[1, 2, 3, 0x1000000]], statssummaryvalues=[1.0], statssummaryshape=[1,1,1,1], l1=l2=[1.0], treecomplexity=[0.5], minnodeweight=[1.0], logitsdimension=3, splittype='inequality')
The implementation needs to validate that each value in statssummaryindices is in range. Patches We have patched the issue in GitHub commit e84c975313e8e8e38bb2ea118196369c45c51378. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Impact An attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to tf.rawops.ResourceScatterUpdate:
python import tensorflow as tf
v = tf.Variable([b'vvv']) tf.rawops.ResourceScatterUpdate( resource=v.handle, indices=[0], updates=['1', '2', '3', '4', '5']) The implementation has an incomplete validation of the relationship between the shapes of indices and updates: instead of checking that the shape of indices is a prefix of the shape of updates (so that broadcasting can happen), code only checks that the number of elements in these two tensors are in a divisibility relationship.
Patches We have patched the issue in GitHub commit 01cff3f986259d661103412a20745928c727326f.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.