Impact The SparseCountSparseOutput and RaggedCountSparseOutput implementations don't validate that the weights tensor has the same shape as the data. The check exists for DenseCountSparseOutput, where both tensors are fully specified: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/countops.cc#L110-L117

In the sparse and ragged count weights are still accessed in parallel with the data: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/countops.cc#L199-L201

But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights.

Patches We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability is a variant of GHSA-p5f8-gfw5-33w4

Issue Description Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent. The block size in meta file might contain a large int64 value which causes an integer overflow upon addition. Subsequent code using n as index may cause an out-of-bounds read.

Impact A maliciously crafted meta checkpoint could be used to cause the TensorFlow process to perform an out of bounds read on in process memory.

Impact

A heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case datasize and numsegments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory.

This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.

Patches

Patched by db4f9717c41bccc3ce10099ab61996b246099892 and released in all official releases after 1.15 and 2.0.

For more information Please consult SECURITY.md for more information regarding the security model and how to contact us with issues and questions.

Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

Patches We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The datasplits argument of tf.rawops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory python >> tf.rawops.StringNGrams(data=["aa", "bb", "cc", "dd", "ee", "ff"], datasplits=[0,8], separator=" ", ngramwidths=[3], leftpad="", rightpad="", padwidth=0, preserveshortsequences=False) StringNGrams(ngrams=<tf.Tensor: shape=(6,), dtype=string, numpy= array([b'aa bb cc', b'bb cc dd', b'cc dd ee', b'dd ee ff', b'ee ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00', b'ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00 \x9b~\xa8q\x7f\x00\x00p\xf5j\xa7q\x7f\x00\x00H\xf8j\xa7q\x7f\x00\x00\xf0\xf3\xf7\x85q\x7f\x00\x00}\xa6\x00\x00\x00\x00\x00~\xa6\x00\x00\x00\x00\x00\xb0~\xeb\x9bq\x7f\x00'],...

All the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.

Patches We have patched the issue in 0462de5b544ed4731aa2fb23946ac22c01856b80 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact When determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

Patches We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.

TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.

Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.

Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.

Patches We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.

Patches We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7.

The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories:

cc if (!fs->Match(childpath, dirs[dirindex])) { ... }

Since dirindex is unconditionaly incremented outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if /tmp/x is a directory that only contains a single file y, then the following scenario will cause a crash due to the out of bounds read:

python >> tf.io.gfile.glob('/tmp/x/') Segmentation fault

There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these.

Patches We have patched the issue in GitHub commit 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

DISPUTED TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.getfile is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives.

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been patched in GitHub commit 4142e47e9e31db481781b955ed3ff807a781b494. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.

Impact Changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments.

We have added fixes to this in f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode.

Patches We have patched the issue in adf095206f25471e864a8e63a0f1caef53a0e3a6 and will release patch releases for all versions between 1.15 and 2.3. Patch releases for versions between 1.15 and 2.1 will also contain cherry-picks of f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Shuaike Dong, from Alipay Tian Qian Security Lab && Lab for Applied Security Research, CUHK.

Impact The Shard API in TensorFlow expects the last argument to be a function taking two int64 (i.e., long long) arguments: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/util/worksharder.h#L59-L60

However, there are several places in TensorFlow where a lambda taking int or int32 arguments is being used: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/randomop.cc#L204-L205 https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/randomop.cc#L317-L318

In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption.

Patches We have patched the issue in 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575. We will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact To mimic Python's indexing with negative values, TFLite uses ResolveAxis to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reduce.h#L68-L72

If the DCHECK does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption. Patches We have patched the issue in 2d88f470dea2671b430884260f3626b1fe99830a and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.

Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.

The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. Patches We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations:

cc int embeddingsize = 1; int lookupsize = 1; for (int i = 0; i < lookuprank - 1; i++, k++) { const int dim = denseshape->data.i32[i]; lookupsize = dim; outputshape->data[k] = dim; } for (int i = 1; i < embeddingrank; i++, k++) { const int dim = SizeOfDimension(value, i); embeddingsize = dim; outputshape->data[k] = dim; }

Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write. Patches We have patched the issue in GitHub commits f19be71717c497723ba0cea0379e84f061a75e01, 1de49725a5fc4e48f1a3b902ec3599ee99283043 and a4e401da71458d253b05e41f28637b65baf64be4.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Patches We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact TensorFlow is vulnerable to a heap OOB write in Grappler:

cc Status SetUnknownShape(const NodeDef node, int outputport) { shapeinference::ShapeHandle shape = GetUnknownOutputShape(node, outputport); InferenceContext ctx = GetContext(node); if (ctx == nullptr) { return errors::InvalidArgument("Missing context"); } ctx->setoutput(outputport, shape); return Status::OK(); }

The setoutput function writes to an array at the specified index:

cc void setoutput(int idx, ShapeHandle shape) { outputs.at(idx) = shape; }

Hence, this gives a malicious user a write primitive.

Patches We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:

python import tensorflow as tf import numpy as np

tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.Dequantize( input=tf.constant([1,1],dtype=tf.qint32), minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: cc if (axis > -1) { numslices = input.dimsize(axis); } // ... int64t predim = 1, postdim = 1; for (int i = 0; i < axis; ++i) { predim = floatoutput.dimsize(i); } for (int i = axis + 1; i < floatoutput.dims(); ++i) { postdim = floatoutput.dimsize(i); } Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:

python import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function def test(): y = tf.rawops.Dequantize( input=input, minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow:

cc int axis = -1; Status s = c->GetAttr("axis", &axis); // ... if (axis < -1) { return errors::InvalidArgument("axis should be at least -1, got ", axis); } // ... if (axis != -1) { ShapeHandle input; TFRETURNIFERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input)); // ... } Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write:

cc for (int i = 0; i < opdef.outputargsize(); i++) { // ... for (int j = 0; j < t->argssize(); j++) { auto arg = t->mutableargs(i); // ... } }

Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

Patches We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.