Impact The implementations of the Minimum and Maximum TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty.

This is because the broadcasting implementation indexes in both tensors with the same index but does not validate that the index is within bounds:

cc auto maxminfunc = & { outputdata[SubscriptToIndex(outputdesc, indexes)] = op(input1data[SubscriptToIndex(desc1, indexes)], input2data[SubscriptToIndex(desc2, indexes)]); };

Patches We have patched the issue in GitHub commit 953f28dca13c92839ba389c055587cfe6c723578.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Passing invalid arguments (e.g., discovered via fuzzing) to tf.rawops.SparseCountSparseOutput results in segfault.

Patches We have patched the issue in GitHub commit 82e6203221865de4008445b13c69b6826d2b28d9.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Passing a complex argument to tf.transpose at the same time as passing conjugate=True argument results in a crash:

python import tensorflow as tf tf.transpose(conjugate=True, a=complex(1))

Patches We have received a patch for the issue in GitHub commit 1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported in #42105 and fixed in #46973.

Impact An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments:

python import tensorflow as tf tf.strings.substr(input='abc', len=1, pos=[1,-1])

python import tensorflow as tf tf.strings.substr(input='abc', len=1, pos=[1,2])

Patches We have received a patch for the issue in GitHub commit 890f7164b70354c57d40eda52dcdd7658677c09f.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported in #46900 and fixed in #46974.

Impact The implementation of TrySimplify has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs.

Patches We have patched the issue in GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input.

Patches We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of tf.io.decoderaw produces incorrect results and crashes the Python interpreter when combining fixedlength and wider datatypes.

python import tensorflow as tf

tf.io.decoderaw(tf.constant(["1","2","3","4"]), tf.uint16, fixedlength=4) The implementation of the padded version is buggy due to a confusion about pointer arithmetic rules.

First, the code computes the width of each output element by dividing the fixedlength value to the size of the type argument:

cc int width = fixedlength / sizeof(T);

The fixedlength argument is also used to determine the size needed for the output tensor:

cc TensorShape outshape = input.shape(); outshape.AddDim(width); Tensor outputtensor = nullptr; OPREQUIRESOK(context, context->allocateoutput("output", outshape, &outputtensor));

auto out = outputtensor->flatinnerdims<T>(); T outdata = out.data(); memset(outdata, 0, fixedlength flatin.size());

This is followed by reencoding code:

cc for (int64 i = 0; i < flatin.size(); ++i) { const T indata = reinterpretcast<const T>(flatin(i).data());

if (flatin(i).size() > fixedlength) { memcpy(outdata, indata, fixedlength); } else { memcpy(outdata, indata, flatin(i).size()); } outdata += fixedlength; }

The erroneous code is the last line above: it is moving the outdata pointer by fixedlength sizeof(T) bytes whereas it only copied at most fixedlength bytes from the input. This results in parts of the input not being decoded into the output.

Furthermore, because the pointer advance is far wider than desired, this quickly leads to writing to outside the bounds of the backing data. This OOB write leads to interpreter crash in the reproducer mentioned here, but more severe attacks can be mounted too, given that this gadget allows writing to periodically placed locations in memory.

Patches We have patched the issue in GitHub commit 698e01511f62a3c185754db78ebce0eee1f0184d.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Incomplete validation in tf.rawops.CTCLoss allows an attacker to trigger an OOB read from heap:

python import tensorflow as tf

inputs = tf.constant([], shape=[10, 16, 0], dtype=tf.float32) labelsindices = tf.constant([], shape=[8, 0], dtype=tf.int64) labelsvalues = tf.constant([-100] 8, shape=[8], dtype=tf.int32) sequencelength = tf.constant([-100] 16, shape=[16], dtype=tf.int32) tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=True, ctcmergerepeated=False, ignorelongeroutputsthaninputs=True) An attacker can also trigger a heap buffer overflow:

python import tensorflow as tf

inputs = tf.constant([], shape=[7, 2, 0], dtype=tf.float32) labelsindices = tf.constant([-100, -100], shape=[2, 1], dtype=tf.int64) labelsvalues = tf.constant([-100, -100], shape=[2], dtype=tf.int32) sequencelength = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=False, ctcmergerepeated=False, ignorelongeroutputsthaninputs=False)

Finally, an attacker can trigger a null pointer dereference:

python import tensorflow as tf

inputs = tf.constant([], shape=[0, 2, 11], dtype=tf.float32) labelsindices = tf.constant([], shape=[0, 2], dtype=tf.int64) labelsvalues = tf.constant([], shape=[0], dtype=tf.int32) sequencelength = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=False, ctcmergerepeated=False, ignorelongeroutputsthaninputs=False)

Patches We have patched the issue in GitHub commit14607c0707040d775e06b6817325640cb4b5864c followed by GitHub commit 4504a081af71514bb1828048363e6540f797005b.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact The validation in tf.rawops.QuantizeAndDequantizeV2 allows invalid values for axis argument:

python import tensorflow as tf

inputtensor = tf.constant([0.0], shape=[1], dtype=float) inputmin = tf.constant(-10.0) inputmax = tf.constant(-10.0)

tf.rawops.QuantizeAndDequantizeV2( input=inputtensor, inputmin=inputmin, inputmax=inputmax, signedinput=False, numbits=1, rangegiven=False, roundmode='HALFTOEVEN', narrowrange=False, axis=-2)

The validation uses || to mix two different conditions:

cc OPREQUIRES(ctx, (axis == -1 || axis < input.shape().dims()), errors::InvalidArgument(...));

If axis < -1 the condition in OPREQUIRES will still be true, but this value of axis results in heap underflow. This allows attackers to read/write to other data on the heap.

Patches We have patched the issue in GitHub commit c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Incomplete validation in SparseReshape results in a denial of service based on a CHECK-failure.

python import tensorflow as tf

inputindices = tf.constant(41, shape=[1, 1], dtype=tf.int64) inputshape = tf.zeros([11], dtype=tf.int64) newshape = tf.zeros([1], dtype=tf.int64)

tf.rawops.SparseReshape(inputindices=inputindices, inputshape=inputshape, newshape=newshape) The implementation has no validation that the input arguments specify a valid sparse tensor.

Patches We have patched the issue in GitHub commit 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

python import tensorflow as tf

aindices = tf.zeros([10, 97], dtype=tf.int64) avalues = tf.zeros([10], dtype=tf.int64) ashape = tf.zeros([0], dtype=tf.int64)

bindices = tf.zeros([0, 0], dtype=tf.int64) bvalues = tf.zeros([0], dtype=tf.int64) bshape = tf.zeros([0], dtype=tf.int64) thresh = 0

tf.rawops.SparseAdd(aindices=aindices, avalues=avalues, ashape=ashape, bindices=bindices, bvalues=bvalues, bshape=bshape, thresh=thresh)

The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

Patches We have patched the issue in GitHub commit 6fd02f44810754ae7481838b6a67c5df7f909ca3 followed by GitHub commit 41727ff06111117bdf86b37db198217fd7a143cc.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Due to lack of validation in tf.rawops.RaggedTensorToTensor, an attacker can exploit an undefined behavior if input arguments are empty:

python import tensorflow as tf

shape = tf.constant([-1, -1], shape=[2], dtype=tf.int64) values = tf.constant([], shape=[0], dtype=tf.int64) defaultvalue = tf.constant(404, dtype=tf.int64) row = tf.constant([269, 404, 0, 0, 0, 0, 0], shape=[7], dtype=tf.int64) rows = [row] types = ['ROWSPLITS']

tf.rawops.RaggedTensorToTensor( shape=shape, values=values, defaultvalue=defaultvalue, rowpartitiontensors=rows, rowpartitiontypes=types)

The implementation only checks that one of the tensors is not empty, but does not check for the other ones.

There are multiple DCHECK validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything.

Patches We have patched the issue in GitHub commit b761c9b652af2107cfbc33efd19be0ce41daa33e followed by GitHub commit f94ef358bb3e91d517446454edff6535bcfe8e4a and GitHub commit c4d7afb6a5986b04505aca4466ae1951686c80f6.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

python import tensorflow as tf

aindices = tf.ones([45, 92], dtype=tf.int64) avalues = tf.ones([45], dtype=tf.int64) ashape = tf.ones([1], dtype=tf.int64) bindices = tf.ones([1, 1], dtype=tf.int64) bvalues = tf.ones([1], dtype=tf.int64) bshape = tf.ones([1], dtype=tf.int64) tf.rawops.SparseSparseMinimum(aindices=aindices, avalues=avalues, ashape=ashape, bindices=bindices, bvalues=bvalues, bshape=bshape)

The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

Patches We have patched the issue in GitHub commit ba6822bd7b7324ba201a28b2f278c29a98edbef2 followed by GitHub commit f6fde895ef9c77d848061c0517f19d0ec2682f3a.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of SplitV:

cc const int inputsize = SizeOfDimension(input, axisvalue);

If axisvalue is not a value between 0 and NumDimensions(input), then the SizeOfDimension function will access data outside the bounds of the tensor shape array:

cc inline int SizeOfDimension(const TfLiteTensor t, int dim) { return t->dims->data[dim]; } Patches We have patched the issue in GitHub commit ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issue:

cc int TfLiteIntArrayGetSizeInBytes(int size) { static TfLiteIntArray dummy; return sizeof(dummy) + sizeof(dummy.data[0]) size; }

An attacker can craft a model such that the size multiplier is so large that the return value overflows the int datatype and becomes negative. In turn, this results in invalid value being given to malloc:

cc TfLiteIntArray TfLiteIntArrayCreate(int size) { TfLiteIntArray ret = (TfLiteIntArray)malloc(TfLiteIntArrayGetSizeInBytes(size)); ret->size = size; return ret; }

In this case, ret->size would dereference an invalid pointer.

Patches We have patched the issue in GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite implementation of hashtable lookup is vulnerable to a division by zero error:

cc const int numrows = SizeOfDimension(value, 0); const int rowbytes = value->bytes / numrows;

An attacker can craft a model such that values's first dimension would be 0.

Patches We have patched the issue in GitHub commit 5117e0851348065ed59c991562c0ec80d9193db2.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of ArgMin/ArgMax:

cc TfLiteIntArray outputdims = TfLiteIntArrayCreate(NumDimensions(input) - 1); int j = 0; for (int i = 0; i < NumDimensions(input); ++i) { if (i != axisvalue) { outputdims->data[j] = SizeOfDimension(input, i); ++j; } }

If axisvalue is not a value between 0 and NumDimensions(input), then the condition in the if is never true, so code writes past the last valid element of outputdims->data. Patches We have patched the issue in GitHub commit c59c37e7b2d563967da813fa50fe20b21f4da683.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of the DepthwiseConv TFLite operator is vulnerable to a division by zero error:

cc int numinputchannels = SizeOfDimension(input, 3); TFLITEENSUREEQ(context, numfilterchannels % numinputchannels, 0);

An attacker can craft a model such that input's fourth dimension would be 0.

Patches We have patched the issue in GitHub commit cbda3c6b2dbbd3fbdc482ff8c0170a78ec2e97d0.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite implementation of concatenation is vulnerable to an integer overflow issue:

cc for (int d = 0; d < t0->dims->size; ++d) { if (d == axis) { sumaxis += t->dims->data[axis]; } else { TFLITEENSUREEQ(context, t->dims->data[d], t0->dims->data[d]); } }

An attacker can craft a model such that the dimensions of one of the concatenation input overflow the values of int. TFLite uses int to represent tensor dimensions, whereas TF uses int64. Hence, valid TF models can trigger an integer overflow when converted to TFLite format.

Patches We have patched the issue in GitHub commit 4253f96a58486ffe84b61c0415bb234a4632ee73.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of the OneHot TFLite operator is vulnerable to a division by zero error:

cc int prefixdimsize = 1; for (int i = 0; i < opcontext.axis; ++i) { prefixdimsize = opcontext.indices->dims->data[i]; } const int suffixdimsize = NumElements(opcontext.indices) / prefixdimsize;

An attacker can craft a model such that at least one of the dimensions of indices would be 0. In turn, the prefixdimsize value would become 0.

Patches We have patched the issue in GitHub commit 3ebedd7e345453d68e279cfc3e4072648e5e12e5.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of the Split TFLite operator is vulnerable to a division by zero error:

cc TFLITEENSUREMSG(context, inputsize % numsplits == 0, "Not an even split"); const int slicesize = inputsize / numsplits;

An attacker can craft a model such that numsplits would be 0.

Patches We have patched the issue in GitHub commit b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of the SVDF TFLite operator is vulnerable to a division by zero error:

cc const int rank = params->rank; ... TFLITEENSUREEQ(context, numfilters % rank, 0);

An attacker can craft a model such that params->rank would be 0.

Patches We have patched the issue in GitHub commit 6841e522a3e7d48706a02e8819836e809f738682.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error:

cc TFLITEENSUREEQ(context, finaldimsize % blockshape[dim], 0); outputsize->data[dim + 1] = finaldimsize / blockshape[dim];

An attacker can craft a model such that one dimension of the block input is 0. Hence, the corresponding value in blockshape is 0.

Patches We have patched the issue in GitHub commit 6d36ba65577006affb272335b7c1abd829010708.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the EmbeddingLookup TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e4b29809543b250bc9b19678ec4776299dd569ba/tensorflow/lite/kernels/embeddinglookup.cc#L73-L74). An attacker can craft a model such that the first dimension of the value input is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Impact The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero error:

cc const int blocksize = params->blocksize; ... const int inputchannels = input->dims->data[3]; ... int outputchannels = inputchannels / blocksize / blocksize;

An attacker can craft a model such that params->blocksize is 0.

Patches We have patched the issue in GitHub commit 106d8f4fb89335a2c52d7c895b7a7485465ca8d9. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger a heap buffer overflow in Eigen implementation of tf.rawops.BandedTriangularSolve:

python import tensorflow as tf import numpy as np matrixarray = np.array([]) matrixtensor = tf.converttotensor(np.reshape(matrixarray,(0,1)),dtype=tf.float32) rhsarray = np.array([1,1]) rhstensor = tf.converttotensor(np.reshape(rhsarray,(1,2)),dtype=tf.float32) tf.rawops.BandedTriangularSolve(matrix=matrixtensor,rhs=rhstensor)

The implementation calls ValidateInputTensors for input validation but fails to validate that the two tensors are not empty: cc void ValidateInputTensors(OpKernelContext ctx, const Tensor& in0, const Tensor& in1) { OPREQUIRES( ctx, in0.dims() >= 2, errors::InvalidArgument("In[0] ndims must be >= 2: ", in0.dims()));

OPREQUIRES( ctx, in1.dims() >= 2, errors::InvalidArgument("In[1] ndims must be >= 2: ", in1.dims())); }

Furthermore, since OPREQUIRES macro only stops execution of current function after setting ctx->status() to a non-OK value, callers of helper functions that use OPREQUIRES must check value of ctx->status() before continuing. This doesn't happen in this op's implementation, hence the validation that is present is also not effective.

Patches We have patched the issue in GitHub commit ba6822bd7b7324ba201a28b2f278c29a98edbef2 followed by GitHub commit 0ab290774f91a23bebe30a358fde4e53ab4876a0.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ye Zhang and Yakun Zhang of Baidu X-Team.

Impact The Prepare step of the SpaceToDepth TFLite operator does not check for 0 before division.

cc const int blocksize = params->blocksize; const int inputheight = input->dims->data[1]; const int inputwidth = input->dims->data[2]; int outputheight = inputheight / blocksize; int outputwidth = inputwidth / blocksize;

An attacker can craft a model such that params->blocksize would be zero.

Patches We have patched the issue in GitHub commit 0d45ea1ca641b21b73bcf9c00e0179cda284e7e7.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling ComputePaddingHeightWidth.

Since users can craft special models which will have params->stride{height,width} be zero, this will result in a division by zero. Patches We have patched the issue in GitHub commit 5f7975d09eac0f10ed8a17dbb6f5964977725adc. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite computation for size of output after padding, ComputeOutSize, does not check that the stride argument is not 0 before doing the division.

cc inline int ComputeOutSize(TfLitePadding padding, int imagesize, int filtersize, int stride, int dilationrate = 1) { int effectivefiltersize = (filtersize - 1) dilationrate + 1; switch (padding) { case kTfLitePaddingSame: return (imagesize + stride - 1) / stride; case kTfLitePaddingValid: return (imagesize + stride - effectivefiltersize) / stride; default: return 0; } } Users can craft special models such that ComputeOutSize is called with stride set to 0.

Patches We have patched the issue in GitHub commit 49847ae69a4e1a97ae7f2db5e217c77721e37948.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger a denial of service via a CHECK-fail in caused by an integer overflow in constructing a new tensor shape:

python import tensorflow as tf

inputlayer = 260-1 sparsedata = tf.rawops.SparseSplit( splitdim=1, indices=[(0, 0), (0, 1), (0, 2), (4, 3), (5, 0), (5, 1)], values=[1.0, 1.0, 1.0, 1.0, 1.0, 1.0], shape=(inputlayer, inputlayer), numsplit=2, name=None ) This is because the implementation builds a dense shape without checking that the dimensions would not result in overflow:

cc sparse::SparseTensor sparsetensor; OPREQUIRESOK(context, sparse::SparseTensor::Create( inputindices, inputvalues, TensorShape(inputshape.vec<int64>()), &sparsetensor));

The TensorShape constructor uses a CHECK operation which triggers when InitDims returns a non-OK status. cc template <class Shape> TensorShapeBase<Shape>::TensorShapeBase(gtl::ArraySlice<int64> dimsizes) { settag(REP16); setdatatype(DTINVALID); TFCHECKOK(InitDims(dimsizes)); }

In our scenario, this occurs when adding a dimension from the argument results in overflow:

cc template <class Shape> Status TensorShapeBase<Shape>::InitDims(gtl::ArraySlice<int64> dimsizes) { ... Status status = Status::OK(); for (int64 s : dimsizes) { status.Update(AddDimWithStatus(internal::SubtleMustCopy(s))); if (!status.ok()) { return status; } } }

template <class Shape> Status TensorShapeBase<Shape>::AddDimWithStatus(int64 size) { ... int64 newnumelements; if (kIsPartial && (numelements() < 0 || size < 0)) { newnumelements = -1; } else { newnumelements = MultiplyWithoutOverflow(numelements(), size); if (TFPREDICTFALSE(newnumelements < 0)) { return errors::Internal("Encountered overflow when multiplying ", numelements(), " with ", size, ", result: ", newnumelements); } } ... }

This is a legacy implementation of the constructor and operations should use BuildTensorShapeBase or AddDimWithStatus to prevent CHECK-failures in the presence of overflows.

Patches We have patched the issue in GitHub commit 4c0ee937c0f61c4fc5f5d32d9bb4c67428012a60.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by researchers from University of Virginia and University of California, Santa Barbara.