Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings python def preprocessinputexprsargstring(inputexprsstr): ... for inputraw in filter(bool, inputexprsstr.split(';')): ... inputkey, expr = inputraw.split('=', 1) inputdict[inputkey] = eval(expr) ... This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a safe flag which defaults to True and an explicit warning for users.

Patches We have patched the issue in GitHub commit 8b202f08d52e8206af2bdb2112a62fafbc546ec7.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Omer Kaspi from Vdoo.

Impact TensorFlow's Grappler optimizer has a use of unitialized variable:

cc const NodeDef dequeuenode; for (const auto& trainnode : trainnodes) { if (IsDequeueOp(trainnode)) { dequeuenode = trainnode; break; } }

if (dequeuenode) { ... }

If the trainnodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeuenode is left unitialized.

Patches We have patched the issue in GitHub commit 68867bf01239d9e1048f98cbad185bf4761bedd3.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Qian Feng from Baidu Security Team.

Impact The ImmutableConst operation in TensorFlow can be tricked into reading arbitrary memory contents:

python import tensorflow as tf with open('/tmp/test','wb') as f: f.write(b'\xe2'128) data = tf.rawops.ImmutableConst(dtype=tf.string,shape=3,memoryregionname='/tmp/test') print(data) This is because the tstring TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype.

Patches We have patched the issue in GitHub commit 3712a2d3455e6ccb924daa5724a3652a86f6b585 and GitHub commit 1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for AllToAll can be made to execute a division by 0:

python import tensorflow as tf @tf.function def func(): return tf.rawops.AllToAll( input=[0.0, 0.1652, 0.6543], groupassignment=[1, -1], concatdimension=0, splitdimension=0, splitcount=0)

func()

This occurs whenever the splitcount argument is 0: cc TFRETURNIFERROR(c->GetAttr("splitcount", &splitcount)); ... for (int32t i = 0; i < rank; ++i) { ... dims[i] = c->MakeDim(c->Value(dims[i]) / splitcount); ... }

Patches We have patched the issue in GitHub commit a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference function for Transpose is vulnerable to a heap buffer overflow:

python import tensorflow as tf @tf.function def test(): y = tf.rawops.Transpose(x=[1,2,3,4],perm=[-10]) return y

test()

This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are all valid: cc for (int32t i = 0; i < rank; ++i) { int64t inidx = data[i]; if (inidx >= rank) { return errors::InvalidArgument("perm dim ", inidx, " is out of range of input rank ", rank); } dims[i] = c->Dim(input, inidx); }

where Dim(tensor, index) accepts either a positive index less than the rank of the tensor or the special value -1 for unknown dimensions.

Patches We have patched the issue in GitHub commit c79ba87153ee343401dbe9d1954d7f79e521eb14.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for the Cudnn operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow:

python import tensorflow as tf

@tf.function def func(): return tf.rawops.CudnnRNNV3( input=[0.1, 0.1], inputh=[0.5], inputc=[0.1, 0.1, 0.1], params=[0.5, 0.5], sequencelengths=[-1, 0, 1]) func() This occurs because the ranks of the input, inputh and inputc parameters are not validated, but code assumes they have certain values:

cc auto inputshape = c->input(0); auto inputhshape = c->input(1); auto seqlength = c->Dim(inputshape, 0); auto batchsize = c->Dim(inputshape, 1); // assumes rank >= 2 auto numunits = c->Dim(inputhshape, 2); // assumes rank >= 3

Patches We have patched the issue in GitHub commit af5fcebb37c8b5d71c237f4e59c6477015c78ce6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of SplitV can trigger a segfault is an attacker supplies negative arguments:

python import tensorflow as tf

tf.rawops.SplitV( value=tf.constant([]), sizesplits=[-1, -2] ,axis=0, numsplit=2) This occurs whenever sizesplits contains more than one value and at least one value is negative. Patches We have patched the issue in GitHub commit 25d622ffc432acc736b14ca3904177579e733cc6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The code behind tf.function API can be made to deadlock when two tf.function decorated Python functions are mutually recursive:

python import tensorflow as tf

@tf.function() def fun1(num): if num == 1: return print(num) fun2(num-1)

@tf.function() def fun2(num): if num == 0: return print(num) fun1(num-1)

fun1(9)

This occurs due to using a non-reentrant Lock Python object.

Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive tf.function, although this is not a frequent scenario.

Patches We have patched the issue in GitHub commit afac8158d43691661ad083f6dd9e56f327c1dcb7.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of ParallelConcat misses some input validation and can produce a division by 0:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ParallelConcat(values=[['tf']],shape=0) return y

test()

Patches We have patched the issue in GitHub commit f2c3931113eaafe9ef558faaddd48e00a6606235.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.

Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.

Patches We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible.

We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues.

Patches We have patched the issue in GitHub commits 68422b215e618df5ad375bcdc6d2052e9fd3080a, 4d74d8a00b07441cba090a02e0dd9ed385145bf4, 579261dcd446385831fe4f7457d802a59685121d, da4aad5946be30e5f049920fa076e1f7ef021261, 4dddb2fd0b01cdd196101afbba6518658a2c9e07, and e7f497570abb6b4ae5af4970620cd880e4c0c904.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments.

Patches We have patched the issue in GitHub commit f2c3931113eaafe9ef558faaddd48e00a6606235. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact While calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition will be cast to double and the result would be truncated before the assignment. This result in overflows:

python import tensorflow as tf

tf.sparse.eye(numrows=9223372036854775807, numcolumns=None) Similarly, tf.range would result in crashes due to overflows if the start or end point are too large.

python import tensorflow as tf

tf.range(start=-1e+38, limit=1)

Patches We have patched the issue in GitHub commits 6d94002a09711d297dbba90390d5482b76113899 (merging #51359) and 1b0e0ec27e7895b9985076eab32445026ae5ca94 (merging #51711).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via GitHub issue, GitHub issue and GitHub issue.

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.QuantizeAndDequantizeV4Grad:

python import tensorflow as tf

gradienttensor = tf.constant([0.0], shape=[1]) inputtensor = tf.constant([0.0], shape=[1]) inputmin = tf.constant([[0.0]], shape=[1, 1]) inputmax = tf.constant([[0.0]], shape=[1, 1])

tf.rawops.QuantizeAndDequantizeV4Grad( gradients=gradienttensor, input=inputtensor, inputmin=inputmin, inputmax=inputmax, axis=0) This is because the implementation does not validate the rank of the input tensors. In turn, this results in the tensors being passes as they are to QuantizeAndDequantizePerChannelGradientImpl:

cc template <typename Device, typename T> struct QuantizeAndDequantizePerChannelGradientImpl { static void Compute(const Device& d, typename TTypes<T, 3>::ConstTensor gradient, typename TTypes<T, 3>::ConstTensor input, const Tensor inputmintensor, const Tensor inputmaxtensor, typename TTypes<T, 3>::Tensor inputbackprop, typename TTypes<T>::Flat inputminbackprop, typename TTypes<T>::Flat inputmaxbackprop) { ... auto inputmin = inputmintensor->vec<T>(); auto inputmax = inputmaxtensor->vec<T>(); ... }

However, the vec<T> method, requires the rank to 1 and triggers a CHECK failure otherwise.

Patches We have patched the issue in GitHub commit 20431e9044cf2ad3c0323c34888b192f3289af6b.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact The implementations of the Minimum and Maximum TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty.

This is because the broadcasting implementation indexes in both tensors with the same index but does not validate that the index is within bounds:

cc auto maxminfunc = & { outputdata[SubscriptToIndex(outputdesc, indexes)] = op(input1data[SubscriptToIndex(desc1, indexes)], input2data[SubscriptToIndex(desc2, indexes)]); };

Patches We have patched the issue in GitHub commit 953f28dca13c92839ba389c055587cfe6c723578.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact Passing invalid arguments (e.g., discovered via fuzzing) to tf.rawops.SparseCountSparseOutput results in segfault.

Patches We have patched the issue in GitHub commit 82e6203221865de4008445b13c69b6826d2b28d9.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Passing a complex argument to tf.transpose at the same time as passing conjugate=True argument results in a crash:

python import tensorflow as tf tf.transpose(conjugate=True, a=complex(1))

Patches We have received a patch for the issue in GitHub commit 1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported in #42105 and fixed in #46973.

Impact An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments:

python import tensorflow as tf tf.strings.substr(input='abc', len=1, pos=[1,-1])

python import tensorflow as tf tf.strings.substr(input='abc', len=1, pos=[1,2])

Patches We have received a patch for the issue in GitHub commit 890f7164b70354c57d40eda52dcdd7658677c09f.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported in #46900 and fixed in #46974.

Impact The implementation of TrySimplify has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs.

Patches We have patched the issue in GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input.

Patches We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of tf.io.decoderaw produces incorrect results and crashes the Python interpreter when combining fixedlength and wider datatypes.

python import tensorflow as tf

tf.io.decoderaw(tf.constant(["1","2","3","4"]), tf.uint16, fixedlength=4) The implementation of the padded version is buggy due to a confusion about pointer arithmetic rules.

First, the code computes the width of each output element by dividing the fixedlength value to the size of the type argument:

cc int width = fixedlength / sizeof(T);

The fixedlength argument is also used to determine the size needed for the output tensor:

cc TensorShape outshape = input.shape(); outshape.AddDim(width); Tensor outputtensor = nullptr; OPREQUIRESOK(context, context->allocateoutput("output", outshape, &outputtensor));

auto out = outputtensor->flatinnerdims<T>(); T outdata = out.data(); memset(outdata, 0, fixedlength flatin.size());

This is followed by reencoding code:

cc for (int64 i = 0; i < flatin.size(); ++i) { const T indata = reinterpretcast<const T>(flatin(i).data());

if (flatin(i).size() > fixedlength) { memcpy(outdata, indata, fixedlength); } else { memcpy(outdata, indata, flatin(i).size()); } outdata += fixedlength; }

The erroneous code is the last line above: it is moving the outdata pointer by fixedlength sizeof(T) bytes whereas it only copied at most fixedlength bytes from the input. This results in parts of the input not being decoded into the output.

Furthermore, because the pointer advance is far wider than desired, this quickly leads to writing to outside the bounds of the backing data. This OOB write leads to interpreter crash in the reproducer mentioned here, but more severe attacks can be mounted too, given that this gadget allows writing to periodically placed locations in memory.

Patches We have patched the issue in GitHub commit 698e01511f62a3c185754db78ebce0eee1f0184d.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Incomplete validation in tf.rawops.CTCLoss allows an attacker to trigger an OOB read from heap:

python import tensorflow as tf

inputs = tf.constant([], shape=[10, 16, 0], dtype=tf.float32) labelsindices = tf.constant([], shape=[8, 0], dtype=tf.int64) labelsvalues = tf.constant([-100] 8, shape=[8], dtype=tf.int32) sequencelength = tf.constant([-100] 16, shape=[16], dtype=tf.int32) tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=True, ctcmergerepeated=False, ignorelongeroutputsthaninputs=True) An attacker can also trigger a heap buffer overflow:

python import tensorflow as tf

inputs = tf.constant([], shape=[7, 2, 0], dtype=tf.float32) labelsindices = tf.constant([-100, -100], shape=[2, 1], dtype=tf.int64) labelsvalues = tf.constant([-100, -100], shape=[2], dtype=tf.int32) sequencelength = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=False, ctcmergerepeated=False, ignorelongeroutputsthaninputs=False)

Finally, an attacker can trigger a null pointer dereference:

python import tensorflow as tf

inputs = tf.constant([], shape=[0, 2, 11], dtype=tf.float32) labelsindices = tf.constant([], shape=[0, 2], dtype=tf.int64) labelsvalues = tf.constant([], shape=[0], dtype=tf.int32) sequencelength = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.rawops.CTCLoss(inputs=inputs, labelsindices=labelsindices, labelsvalues=labelsvalues, sequencelength=sequencelength, preprocesscollapserepeated=False, ctcmergerepeated=False, ignorelongeroutputsthaninputs=False)

Patches We have patched the issue in GitHub commit14607c0707040d775e06b6817325640cb4b5864c followed by GitHub commit 4504a081af71514bb1828048363e6540f797005b.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact The validation in tf.rawops.QuantizeAndDequantizeV2 allows invalid values for axis argument:

python import tensorflow as tf

inputtensor = tf.constant([0.0], shape=[1], dtype=float) inputmin = tf.constant(-10.0) inputmax = tf.constant(-10.0)

tf.rawops.QuantizeAndDequantizeV2( input=inputtensor, inputmin=inputmin, inputmax=inputmax, signedinput=False, numbits=1, rangegiven=False, roundmode='HALFTOEVEN', narrowrange=False, axis=-2)

The validation uses || to mix two different conditions:

cc OPREQUIRES(ctx, (axis == -1 || axis < input.shape().dims()), errors::InvalidArgument(...));

If axis < -1 the condition in OPREQUIRES will still be true, but this value of axis results in heap underflow. This allows attackers to read/write to other data on the heap.

Patches We have patched the issue in GitHub commit c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Incomplete validation in SparseReshape results in a denial of service based on a CHECK-failure.

python import tensorflow as tf

inputindices = tf.constant(41, shape=[1, 1], dtype=tf.int64) inputshape = tf.zeros([11], dtype=tf.int64) newshape = tf.zeros([1], dtype=tf.int64)

tf.rawops.SparseReshape(inputindices=inputindices, inputshape=inputshape, newshape=newshape) The implementation has no validation that the input arguments specify a valid sparse tensor.

Patches We have patched the issue in GitHub commit 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

python import tensorflow as tf

aindices = tf.zeros([10, 97], dtype=tf.int64) avalues = tf.zeros([10], dtype=tf.int64) ashape = tf.zeros([0], dtype=tf.int64)

bindices = tf.zeros([0, 0], dtype=tf.int64) bvalues = tf.zeros([0], dtype=tf.int64) bshape = tf.zeros([0], dtype=tf.int64) thresh = 0

tf.rawops.SparseAdd(aindices=aindices, avalues=avalues, ashape=ashape, bindices=bindices, bvalues=bvalues, bshape=bshape, thresh=thresh)

The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

Patches We have patched the issue in GitHub commit 6fd02f44810754ae7481838b6a67c5df7f909ca3 followed by GitHub commit 41727ff06111117bdf86b37db198217fd7a143cc.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Due to lack of validation in tf.rawops.RaggedTensorToTensor, an attacker can exploit an undefined behavior if input arguments are empty:

python import tensorflow as tf

shape = tf.constant([-1, -1], shape=[2], dtype=tf.int64) values = tf.constant([], shape=[0], dtype=tf.int64) defaultvalue = tf.constant(404, dtype=tf.int64) row = tf.constant([269, 404, 0, 0, 0, 0, 0], shape=[7], dtype=tf.int64) rows = [row] types = ['ROWSPLITS']

tf.rawops.RaggedTensorToTensor( shape=shape, values=values, defaultvalue=defaultvalue, rowpartitiontensors=rows, rowpartitiontypes=types)

The implementation only checks that one of the tensors is not empty, but does not check for the other ones.

There are multiple DCHECK validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything.

Patches We have patched the issue in GitHub commit b761c9b652af2107cfbc33efd19be0ce41daa33e followed by GitHub commit f94ef358bb3e91d517446454edff6535bcfe8e4a and GitHub commit c4d7afb6a5986b04505aca4466ae1951686c80f6.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

python import tensorflow as tf

aindices = tf.ones([45, 92], dtype=tf.int64) avalues = tf.ones([45], dtype=tf.int64) ashape = tf.ones([1], dtype=tf.int64) bindices = tf.ones([1, 1], dtype=tf.int64) bvalues = tf.ones([1], dtype=tf.int64) bshape = tf.ones([1], dtype=tf.int64) tf.rawops.SparseSparseMinimum(aindices=aindices, avalues=avalues, ashape=ashape, bindices=bindices, bvalues=bvalues, bshape=bshape)

The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

Patches We have patched the issue in GitHub commit ba6822bd7b7324ba201a28b2f278c29a98edbef2 followed by GitHub commit f6fde895ef9c77d848061c0517f19d0ec2682f3a.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Impact A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of SplitV:

cc const int inputsize = SizeOfDimension(input, axisvalue);

If axisvalue is not a value between 0 and NumDimensions(input), then the SizeOfDimension function will access data outside the bounds of the tensor shape array:

cc inline int SizeOfDimension(const TfLiteTensor t, int dim) { return t->dims->data[dim]; } Patches We have patched the issue in GitHub commit ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issue:

cc int TfLiteIntArrayGetSizeInBytes(int size) { static TfLiteIntArray dummy; return sizeof(dummy) + sizeof(dummy.data[0]) size; }

An attacker can craft a model such that the size multiplier is so large that the return value overflows the int datatype and becomes negative. In turn, this results in invalid value being given to malloc:

cc TfLiteIntArray TfLiteIntArrayCreate(int size) { TfLiteIntArray ret = (TfLiteIntArray)malloc(TfLiteIntArrayGetSizeInBytes(size)); ret->size = size; return ret; }

In this case, ret->size would dereference an invalid pointer.

Patches We have patched the issue in GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The TFLite implementation of hashtable lookup is vulnerable to a division by zero error:

cc const int numrows = SizeOfDimension(value, 0); const int rowbytes = value->bytes / numrows;

An attacker can craft a model such that values's first dimension would be 0.

Patches We have patched the issue in GitHub commit 5117e0851348065ed59c991562c0ec80d9193db2.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.