Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

Patches We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.

Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.

The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. Patches We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations:

cc int embeddingsize = 1; int lookupsize = 1; for (int i = 0; i < lookuprank - 1; i++, k++) { const int dim = denseshape->data.i32[i]; lookupsize = dim; outputshape->data[k] = dim; } for (int i = 1; i < embeddingrank; i++, k++) { const int dim = SizeOfDimension(value, i); embeddingsize = dim; outputshape->data[k] = dim; }

Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write. Patches We have patched the issue in GitHub commits f19be71717c497723ba0cea0379e84f061a75e01, 1de49725a5fc4e48f1a3b902ec3599ee99283043 and a4e401da71458d253b05e41f28637b65baf64be4.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Patches We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact TensorFlow is vulnerable to a heap OOB write in Grappler:

cc Status SetUnknownShape(const NodeDef node, int outputport) { shapeinference::ShapeHandle shape = GetUnknownOutputShape(node, outputport); InferenceContext ctx = GetContext(node); if (ctx == nullptr) { return errors::InvalidArgument("Missing context"); } ctx->setoutput(outputport, shape); return Status::OK(); }

The setoutput function writes to an array at the specified index:

cc void setoutput(int idx, ShapeHandle shape) { outputs.at(idx) = shape; }

Hence, this gives a malicious user a write primitive.

Patches We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:

python import tensorflow as tf import numpy as np

tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.Dequantize( input=tf.constant([1,1],dtype=tf.qint32), minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: cc if (axis > -1) { numslices = input.dimsize(axis); } // ... int64t predim = 1, postdim = 1; for (int i = 0; i < axis; ++i) { predim = floatoutput.dimsize(i); } for (int i = axis + 1; i < floatoutput.dims(); ++i) { postdim = floatoutput.dimsize(i); } Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:

python import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function def test(): y = tf.rawops.Dequantize( input=input, minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow:

cc int axis = -1; Status s = c->GetAttr("axis", &axis); // ... if (axis < -1) { return errors::InvalidArgument("axis should be at least -1, got ", axis); } // ... if (axis != -1) { ShapeHandle input; TFRETURNIFERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input)); // ... } Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write:

cc for (int i = 0; i < opdef.outputargsize(); i++) { // ... for (int j = 0; j < t->argssize(); j++) { auto arg = t->mutableargs(i); // ... } }

Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

Patches We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:

cc TfLiteIntArray TfLiteIntArrayCreate(int size) { int allocsize = TfLiteIntArrayGetSizeInBytes(size); // ... TfLiteIntArray ret = (TfLiteIntArray)malloc(allocsize); // ... }

The TfLiteIntArrayGetSizeInBytes returns an int instead of a sizet:

cc int TfLiteIntArrayGetSizeInBytes(int size) { static TfLiteIntArray dummy;

int computedsize = sizeof(dummy) + sizeof(dummy.data[0]) size; #if defined(MSCVER) // Context for why this is needed is in http://b/189926408#comment21 computedsize -= sizeof(dummy.data[0]); #endif return computedsize; }

An attacker can control model inputs such that computedsize overflows the size of int datatype.

Patches We have patched the issue in GitHub commit a1e1511dde36b3f8aa27a6ec630838e7ea40e091.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[2,2,2,2], outbackprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]], rowpoolingsequence=[-10,1,2,3], colpoolingsequence=[1,2,3,4], overlapping=True) return y test()

Patches We have patched the issue in GitHub commit 002408c3696b173863228223d535f9de72a101a9.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ReverseSequence( input = ['aaa','bbb'], seqlengths = [1,1,1], seqdim = -10, batchdim = -10 ) return y test()

There is a check to make sure the value of batchdim does not go over the rank of the input, but there is no check for negative values:

cc const int32t inputrank = c->Rank(input); if (batchdim >= inputrank) { return errors::InvalidArgument( "batchdim must be < input rank: ", batchdim, " vs. ", inputrank); } // ... DimensionHandle batchdimdim = c->Dim(input, batchdim); Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of Dim would access elements before the start of an array:

cc DimensionHandle Dim(ShapeHandle s, int64t idx) { if (!s.Handle() || s->rank == kUnknownRank) { return UnknownDim(); } return DimKnownRank(s, idx); } · static DimensionHandle DimKnownRank(ShapeHandle s, int64t idx) { CHECKNE(s->rank, kUnknownRank); if (idx < 0) { return s->dims[s->dims.size() + idx]; } return s->dims[idx]; }

Patches We have patched the issue in GitHub commit 37c01fb5e25c3d80213060460196406c43d31995.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:

python import tensorflow as tf import numpy as np

tf.rawops.SparseTensorSliceDataset( indices=[[]], values=[], denseshape=[1,1])

The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.

Patches We have patched the issue in GitHub commit 965b97e4a9650495cda5a8c210ef6684b4b9eceb.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if (/ ... error conditions ... /) { png::CommonFreeDecode(&decode); OPREQUIRES(context, false, errors::InvalidArgument("PNG size too large for int: ", decode.width, " by ", decode.height)); } After png::CommonFreeDecode(&decode) gets called, the values of decode.width and decode.height are in an unspecified state.

Patches We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel:

library { function { signature { name: "SomeOp" description: "Self recursive op" } nodedef { name: "1" op: "SomeOp" } nodedef { name: "2" op: "SomeOp" } } }

This would result in a stack overflow during execution as resolving each NodeDef means resolving the function itself and its nodes.

Patches We have patched the issue in GitHub commit 448a16182065bd08a202d9057dd8ca541e67996c.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).

In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the mktemp function usage.

Patches We have patched the issue in several commits, replacing mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.

Impact An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated.

Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer:

cc const auto& initopsigit = metagraphdef.signaturedef().find(kSavedModelInitOpSignatureKey); if (initopsigit != sigdefmap.end()) { initopname = initopsigit->second.outputs() .find(kSavedModelInitOpSignatureKey) ->second.name(); return Status::OK(); }

Here, we have a nested map and we assume that if the first .find succeeds then so would be the search in the internal map. However, the maps are built based on the SavedModel protobuf format and a malicious user can alter that on disk before loading to cause the second .find to return nullptr. Patches We have patched the issue in GitHub commit 4f38b1ac8e42727e18a2f0bde06d3bee8e77b250.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference:

cc void InferenceContext::PreInputInit( const OpDef& opdef, const std::vector<const Tensor>& inputtensors, const std::vector<ShapeHandle>& inputtensorsasshapes) { const auto ret = fulltype::SpecializeType(attrs, opdef); DCHECK(ret.status().ok()) << "while instantiating types: " << ret.status(); rettypes = ret.ValueOrDie(); // ... }

However, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the ValueOrDie line. This results in an assertion failure as ret contains an error Status, not a value. In the second case we also get a crash due to the assertion failure. Patches We have patched the issue in GitHub commit cb164786dc891ea11d3a900e90367c339305dc7b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes.

Patches We have patched the issue in GitHub commit 5b491cd5e41ad63735161cec9c2a568172c8b6a3. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:

cc const auto attr = attrs.Find(arg->s()); DCHECK(attr != nullptr); if (attr->valuecase() == AttrValue::kList) { // ... } However, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure.

Patches We have patched the issue in GitHub commit 8a513cec4bec15961fbfdedcaa5376522980455c.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for (const auto& dim : outputshape.dim()) { outputsize = dim.size(); } Here, we can have a large enough number of dimensions in outputshape.dim() or just a small number of dimensions being large enough to cause an overflow in the multiplication.

Patches We have patched the issue in GitHub commit b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes.

Patches We have patched the issue in GitHub commit 14fea662350e7c26eb5fe1be2ac31704e5682ee6.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects (so, an assert failure based denial of service):

python import tensorflow as tf import numpy as np

tf.rawops.AddManySparseToTensorsMap( sparseindices=[(0,0),(0,1),(0,2),(4,3),(5,0),(5,1)], sparsevalues=[1,1,1,1,1,1], sparseshape=[232,232], container='', sharedname='', name=None)

We are missing some validation on the shapes of the input tensors as well as directly constructing a large TensorShape with user-provided dimensions. The latter is an instance of TFSA-2021-198 (CVE-2021-41197) and is easily fixed by replacing a call to TensorShape constructor with a call to BuildTensorShape static helper factory. Patches We have patched the issue in GitHub commits b51b82fe65ebace4475e3c54eb089c18a4403f1c and a68f68061e263a88321c104a6c911fe5598050a8.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact Multiple operations in TensorFlow can be used to trigger a denial of service via CHECK-fails (i.e., assertion failures). This is similar to TFSA-2021-198 (CVE-2021-41197) and has similar fixes.

Patches We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar:

python import tensorflow as tf import numpy as np

tf.rawops.MapStage( key = tf.constant(value=[4], shape= (1,2), dtype=tf.int64), indices = np.array([[6]]), values = np.array([-60]), dtypes = [tf.int64], capacity=0, memorylimit=0, container='', sharedname='', name=None )

Patches We have patched the issue in GitHub commit f57315566d7094f322b784947093406c2aea0d7d.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia. ~

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0:

python import tensorflow as tf

@tf.function def test(): y=tf.rawops.AvgPoolGrad( originputshape=[1,1,1,1], grad=[[[[1.0],[1.0],[1.0]]],[[[2.0],[2.0],[2.0]]],[[[3.0],[3.0],[3.0]]]], ksize=[1,1,1,1], strides=[1,1,1,0], padding='VALID', dataformat='NCHW') return y

test()

The function fails to check that the stride argument is stricly positive:

cc int64t GetOutputSize(const int64t input, const int64t filter, const int64t stride, const Padding& padding) { // Logic for calculating output shape is from GetWindowedOutputSizeVerbose() // function in thirdparty/tensorflow/core/framework/commonshapefns.cc. if (padding == Padding::VALID) { return (input - filter + stride) / stride; } else { // SAME. return (input + stride - 1) / stride; } }

Hence, the fix is to add a check for the stride argument to ensure it is valid.

Patches We have patched the issue in GitHub commit 3218043d6d3a019756607643cf65574fbfef5d7a.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug:

python import tensorflow as tf

tf.rawops.UnravelIndex(indices=-0x100000,dims=[0x100000,0x100000])

Patches We have patched the issue in GitHub commit 58b34c6c8250983948b5a781b426f6aa01fd47af. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.