Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.

Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.

Patches We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

DISPUTED TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.getfile is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives.

Impact The shape inference function for Transpose is vulnerable to a heap buffer overflow:

python import tensorflow as tf @tf.function def test(): y = tf.rawops.Transpose(x=[1,2,3,4],perm=[-10]) return y

test()

This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are all valid: cc for (int32t i = 0; i < rank; ++i) { int64t inidx = data[i]; if (inidx >= rank) { return errors::InvalidArgument("perm dim ", inidx, " is out of range of input rank ", rank); } dims[i] = c->Dim(input, inidx); }

where Dim(tensor, index) accepts either a positive index less than the rank of the tensor or the special value -1 for unknown dimensions.

Patches We have patched the issue in GitHub commit c79ba87153ee343401dbe9d1954d7f79e521eb14.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact During execution, EinsumHelper::ParseEquation() is supposed to set the flags in inputhasellipsis vector and outputhasellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output.

However, the code only changes these flags to true and never assigns false.

cc for (int i = 0; i < numinputs; ++i) { inputlabelcounts->at(i).resize(numlabels); for (const int label : inputlabels->at(i)) { if (label != kEllipsisLabel) inputlabelcounts->at(i)[label] += 1; else inputhasellipsis->at(i) = true; } } outputlabelcounts->resize(numlabels); for (const int label : outputlabels) { if (label != kEllipsisLabel) outputlabelcounts->at(label) += 1; else outputhasellipsis = true; }

This results in unitialized variable access if callers assume that EinsumHelper::ParseEquation() always sets these flags.

Patches We have patched the issue in GitHub commit f09caa532b6e1ac8d2aa61b7832c78c5b79300c6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr:

python import tensorflow as tf tf.rawops.SparseMatMul( a=[[1.0,1.0,1.0]], b=[[],[],[]], transposea=False, transposeb=False, aissparse=False, bissparse=True)

This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access.

Patches We have patched the issue in GitHub commit e6cf28c72ba2eb949ca950d834dd6d66bb01cfae.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow.

This is because the checkpoints loading infrastructure is missing validation for invalid file formats.

Patches We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible.

We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues.

Patches We have patched the issue in GitHub commits 68422b215e618df5ad375bcdc6d2052e9fd3080a, 4d74d8a00b07441cba090a02e0dd9ed385145bf4, 579261dcd446385831fe4f7457d802a59685121d, da4aad5946be30e5f049920fa076e1f7ef021261, 4dddb2fd0b01cdd196101afbba6518658a2c9e07, and e7f497570abb6b4ae5af4970620cd880e4c0c904.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. In the following scenario, this results in a crash:

python import tensorflow as tf @tf.function def test(): y = tf.ragged.cross([tf.ragged.constant([['1']]),'2']) return y test() Patches We have patched the issue in GitHub commit fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for the Cudnn operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow:

python import tensorflow as tf

@tf.function def func(): return tf.rawops.CudnnRNNV3( input=[0.1, 0.1], inputh=[0.5], inputc=[0.1, 0.1, 0.1], params=[0.5, 0.5], sequencelengths=[-1, 0, 1]) func() This occurs because the ranks of the input, inputh and inputc parameters are not validated, but code assumes they have certain values:

cc auto inputshape = c->input(0); auto inputhshape = c->input(1); auto seqlength = c->Dim(inputshape, 0); auto batchsize = c->Dim(inputshape, 1); // assumes rank >= 2 auto numunits = c->Dim(inputhshape, 2); // assumes rank >= 3

Patches We have patched the issue in GitHub commit af5fcebb37c8b5d71c237f4e59c6477015c78ce6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings python def preprocessinputexprsargstring(inputexprsstr): ... for inputraw in filter(bool, inputexprsstr.split(';')): ... inputkey, expr = inputraw.split('=', 1) inputdict[inputkey] = eval(expr) ... This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a safe flag which defaults to True and an explicit warning for users.

Patches We have patched the issue in GitHub commit 8b202f08d52e8206af2bdb2112a62fafbc546ec7.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Omer Kaspi from Vdoo.

Impact TensorFlow's Grappler optimizer has a use of unitialized variable:

cc const NodeDef dequeuenode; for (const auto& trainnode : trainnodes) { if (IsDequeueOp(trainnode)) { dequeuenode = trainnode; break; } }

if (dequeuenode) { ... }

If the trainnodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeuenode is left unitialized.

Patches We have patched the issue in GitHub commit 68867bf01239d9e1048f98cbad185bf4761bedd3.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Qian Feng from Baidu Security Team.

Impact The implementation of SparseBinCount is vulnerable to a heap OOB:

python import tensorflow as tf tf.rawops.SparseBincount( indices=[[0],[1],[2]] values=[0,-10000000] denseshape=[1,1] size=[1] weights=[3,2,1] binaryoutput=False)

This is because of missing validation between the elements of the values argument and the shape of the sparse output:

cc for (int64t i = 0; i < indicesmat.dimension(0); ++i) { const int64t batch = indicesmat(i, 0); const Tidx bin = values(i); ... out(batch, bin) = ...; }

Patches We have patched the issue in GitHub commit f410212e373eb2aec4c9e60bf3702eba99a38aba.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference functions for the QuantizeAndDequantizeV operations can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs:

python import tensorflow as tf

@tf.function def test(): data=tf.rawops.QuantizeAndDequantizeV4Grad( gradients=[1.0,1.0], input=[1.0,1.0], inputmin=[1.0,10.0], inputmax=[1.0,10.0], axis=-100) return data

test()

python import tensorflow as tf

@tf.function def test(): data=tf.rawops.QuantizeAndDequantizeV4( input=[1.0,1.0], inputmin=[1.0,10.0], inputmax=[1.0,10.0], signedinput=False, numbits=10, rangegiven=False, roundmode='HALFTOEVEN', narrowrange=False, axis=-100) return data

test()

python import tensorflow as tf

@tf.function def test(): data=tf.rawops.QuantizeAndDequantizeV3( input=[1.0,1.0], inputmin=[1.0,10.0], inputmax=[1.0,10.0], signedinput=False, numbits=10, rangegiven=False, narrowrange=False, axis=-100) return data

test()

python import tensorflow as tf

@tf.function def test(): data=tf.rawops.QuantizeAndDequantizeV2( input=[1.0,1.0], inputmin=[1.0,10.0], inputmax=[1.0,10.0], signedinput=False, numbits=10, rangegiven=False, roundmode='HALFTOEVEN', narrowrange=False, axis=-100) return data

test()

In all of these cases, axis is a negative value different than the special value used for optional/unknown dimensions (i.e., -1). However, the code ignores the occurences of these values:

cc ... if (axis != -1) { ... c->Dim(input, axis); ... }

Patches We have patched the issue in GitHub commit 7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference functions for SparseCountSparseOutput can trigger a read outside of bounds of heap allocated array:

python import tensorflow as tf

@tf.function def func(): return tf.rawops.SparseCountSparseOutput( indices=[1], values=[[1]], denseshape=[10], weights=[], binaryoutput= True)

func()

The function fails to check that the first input (i.e., indices) has rank 2:

cc auto rank = c->Dim(c->input(0), 1);

Patches We have patched the issue in GitHub commit 701cfaca222a82afbeeb17496bd718baa65a67d2.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of SparseFillEmptyRows can be made to trigger a heap OOB access:

python import tensorflow as tf data=tf.rawops.SparseFillEmptyRows( indices=[[0,0],[0,0],[0,0]], values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'], denseshape=[5,3], defaultvalue='o') This occurs whenever the size of indices does not match the size of values.

Patches We have patched the issue in GitHub commit 67bfd9feeecfb3c61d80f0e46d89c170fbee682b.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of FusedBatchNorm kernels is vulnerable to a heap OOB:

python import tensorflow as tf tf.rawops.FusedBatchNormGrad( ybackprop=tf.constant([i for i in range(9)],shape=(1,1,3,3),dtype=tf.float32) x=tf.constant([i for i in range(2)],shape=(1,1,1,2),dtype=tf.float32) scale=[1,1], reservespace1=[1,1], reservespace2=[1,1,1], epsilon=1.0, dataformat='NCHW', istraining=True) Patches We have patched the issue in GitHub commit aab9998916c2ffbd8f0592059fad352622f89cda.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.RaggedCross(raggedvalues=[], raggedrowsplits=[], sparseindices=[[5]], sparsevalues=[], sparseshape=[5], denseinputs=[['a']], inputorder='RD', hashedoutput=False, numbuckets=5, hashkey=2, outvaluestype=tf.string, outrowsplitstype=tf.int64) return y

test()

Patches We have patched the issue in GitHub commit fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The ImmutableConst operation in TensorFlow can be tricked into reading arbitrary memory contents:

python import tensorflow as tf with open('/tmp/test','wb') as f: f.write(b'\xe2'128) data = tf.rawops.ImmutableConst(dtype=tf.string,shape=3,memoryregionname='/tmp/test') print(data) This is because the tstring TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype.

Patches We have patched the issue in GitHub commit 3712a2d3455e6ccb924daa5724a3652a86f6b585 and GitHub commit 1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for AllToAll can be made to execute a division by 0:

python import tensorflow as tf @tf.function def func(): return tf.rawops.AllToAll( input=[0.0, 0.1652, 0.6543], groupassignment=[1, -1], concatdimension=0, splitdimension=0, splitcount=0)

func()

This occurs whenever the splitcount argument is 0: cc TFRETURNIFERROR(c->GetAttr("splitcount", &splitcount)); ... for (int32t i = 0; i < rank; ++i) { ... dims[i] = c->MakeDim(c->Value(dims[i]) / splitcount); ... }

Patches We have patched the issue in GitHub commit a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of ParallelConcat misses some input validation and can produce a division by 0:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ParallelConcat(values=[['tf']],shape=0) return y

test()

Patches We have patched the issue in GitHub commit f2c3931113eaafe9ef558faaddd48e00a6606235.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact If tf.image.resize is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow.

python import tensorflow as tf import numpy as np

tf.keras.layers.UpSampling2D( size=1610637938, dataformat='channelsfirst', interpolation='bilinear')(np.ones((5,1,1,1)))

The number of elements in the output tensor is too much for the int64t type and the overflow is detected via a CHECK statement. This aborts the process.

Patches We have patched the issue in GitHub commit e5272d4204ff5b46136a1ef1204fc00597e21837 (merging #51497).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via a GitHub issue.

Impact If tf.tile is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow.

python import tensorflow as tf import numpy as np tf.keras.backend.tile(x=np.ones((1,1,1)), n=[100000000,100000000, 100000000])

The number of elements in the output tensor is too much for the int64t type and the overflow is detected via a CHECK statement. This aborts the process.

Patches We have patched the issue in GitHub commit 9294094df6fea79271778eb7e7ae1bad8b5ef98f (merging #51138).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via a GitHub issue.

Impact The process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not: python import tensorflow as tf @tf.function def func(): return tf.rawops.Exit(data=[False,False]) func()

This occurs because the code assumes that the first node in the pairing (e.g., an Enter node) always exists when encountering the second node (e.g., an Exit node): cc ... } else if (IsExit(currnode)) { // Exit to the parent frame. parent = parentnodes[currid]; framename = cfinfo->framenames[parent->id()]; ...

When this is not the case, parent is nullptr so dereferencing it causes a crash.

Patches We have patched the issue in GitHub commit 05cbebd3c6bb8f517a158b0155debb8df79017ff.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact During TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change.

Patches We have patched the issue in GitHub commit 7731e8dfbe4a56773be5dc94d631611211156659.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions

Impact While calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition will be cast to double and the result would be truncated before the assignment. This result in overflows:

python import tensorflow as tf

tf.sparse.eye(numrows=9223372036854775807, numcolumns=None) Similarly, tf.range would result in crashes due to overflows if the start or end point are too large.

python import tensorflow as tf

tf.range(start=-1e+38, limit=1)

Patches We have patched the issue in GitHub commits 6d94002a09711d297dbba90390d5482b76113899 (merging #51359) and 1b0e0ec27e7895b9985076eab32445026ae5ca94 (merging #51711).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via GitHub issue, GitHub issue and GitHub issue.

Impact The implementation of tf.math.segment operations results in a CHECK-fail related abort (and denial of service) if a segment id in segmentids is large.

python import tensorflow as tf

tf.math.segmentmax(data=np.ones((1,10,1)), segmentids=[1676240524292489355]) tf.math.segmentmin(data=np.ones((1,10,1)), segmentids=[1676240524292489355]) tf.math.segmentmean(data=np.ones((1,10,1)), segmentids=[1676240524292489355]) tf.math.segmentsum(data=np.ones((1,10,1)), segmentids=[1676240524292489355]) tf.math.segmentprod(data=np.ones((1,10,1)), segmentids=[1676240524292489355])

This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using AddDim. However, if the number of elements in the tensor overflows an int64t value, AddDim results in a CHECK failure which provokes a std::abort. Instead, code should use AddDimWithStatus.

Patches We have patched the issue in GitHub commit e9c81c1e1a9cd8dd31f4e83676cab61b60658429 (merging #51733).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via a GitHub issue.

Impact The shape inference code for DeserializeSparse can trigger a null pointer dereference:

python import tensorflow as tf

dataset = tf.data.Dataset.range(3) @tf.function def test(): y = tf.rawops.DeserializeSparse( serializedsparse=tf.data.experimental.tovariant(dataset), dtype=tf.int32)

test()

This is because the shape inference function assumes that the serializesparse tensor is a tensor with positive rank (and having 3 as the last dimension). However, in the example above, the argument is a scalar (i.e., rank 0).

Patches We have patched the issue in GitHub commit d3738dd70f1c9ceb547258cbb82d853da8771850.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an int64t. If an overflow occurs, MultiplyWithoutOverflow would return a negative result. In the majority of TensorFlow codebase this then results in a CHECK-failure. Newer constructs exist which return a Status instead of crashing the binary.

For example AddDim calls should be replaced by AddDimWithStatus.

This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs).

Patches We have patched the issue in GitHub commits 7c1692bd417eb4f9b33ead749a41166d6080af85 (merging #51732), d81b1351da3e8c884ff836b64458d94e4a157c15 (merging #51717), a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf (merging #51658), and d81b1351da3e8c884ff836b64458d94e4a157c15 (merging #51973). It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via GitHub issue, GitHub issue and GitHub issue.

Impact The implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments.

Patches We have patched the issue in GitHub commit f2c3931113eaafe9ef558faaddd48e00a6606235. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact If tf.summary.createfilewriter is called with non-scalar arguments code crashes due to a CHECK-fail.

python import tensorflow as tf import numpy as np tf.summary.createfilewriter(logdir='', flushmillis=np.ones((1,2)))

Patches We have patched the issue in GitHub commit 874bda09e6702cd50bac90b453b50bcc65b2769e (merging #51715).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported externally via a GitHub issue.