Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects (so, an assert failure based denial of service):

python import tensorflow as tf import numpy as np

tf.rawops.AddManySparseToTensorsMap( sparseindices=[(0,0),(0,1),(0,2),(4,3),(5,0),(5,1)], sparsevalues=[1,1,1,1,1,1], sparseshape=[232,232], container='', sharedname='', name=None)

We are missing some validation on the shapes of the input tensors as well as directly constructing a large TensorShape with user-provided dimensions. The latter is an instance of TFSA-2021-198 (CVE-2021-41197) and is easily fixed by replacing a call to TensorShape constructor with a call to BuildTensorShape static helper factory. Patches We have patched the issue in GitHub commits b51b82fe65ebace4475e3c54eb089c18a4403f1c and a68f68061e263a88321c104a6c911fe5598050a8.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact Multiple operations in TensorFlow can be used to trigger a denial of service via CHECK-fails (i.e., assertion failures). This is similar to TFSA-2021-198 (CVE-2021-41197) and has similar fixes.

Patches We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementations of SparseCwise ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or CHECK-fails when building new TensorShape objects (so, assert failures based denial of service):

python import tensorflow as tf import numpy as np

tf.rawops.SparseDenseCwiseDiv( spindices=np.array([[9]]), spvalues=np.array([5]), spshape=np.array([92233720368., 92233720368]), dense=np.array([4]))

We are missing some validation on the shapes of the input tensors as well as directly constructing a large TensorShape with user-provided dimensions. The latter is an instance of TFSA-2021-198 (CVE-2021-41197) and is easily fixed by replacing a call to TensorShape constructor with a call to BuildTensorShape static helper factory.

Patches We have patched the issue in GitHub commits 1b54cadd19391b60b6fcccd8d076426f7221d5e8 and e952a89b7026b98fe8cbe626514a93ed68b7c510.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:

python import tensorflow as tf import numpy as np

tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions.

The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is stricly positive.

Patches We have patched the issue in GitHub commit e5b0eec199c2d03de54fd6a7fd9275692218e2bc. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:

python import tensorflow as tf import numpy as np

tf.rawops.SparseTensorSliceDataset( indices=[[]], values=[], denseshape=[1,1])

The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.

Patches We have patched the issue in GitHub commit 965b97e4a9650495cda5a8c210ef6684b4b9eceb.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation:

python import tensorflow as tf import numpy as np tf.rawops.SparseCountSparseOutput( indices=[[1,1]], values=[2], denseshape=[2 31, 2 32], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commit 6f4d3e8139ec724dbbcb40505891c81dd1052c4a.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail:

python import tensorflow as tf

tf.rawops.DenseBincount( input=[[0], [1], [2]], size=[1], weights=[3,2,1], binaryoutput=False)

There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in CHECK failures later when the output tensors get allocated.

Patches We have patched the issue in GitHub commit 7019ce4f68925fd01cdafde26f8d8c938f47e6f9.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer.

python import tensorflow as tf

tf.rawops.QuantizedMaxPool( input = tf.constant([[[[4]]]], dtype=tf.quint8), mininput = [], maxinput = [1], ksize = [1, 1, 1, 1], strides = [1, 1, 1, 1], padding = "SAME", name=None )

Patches We have patched the issue in GitHub commit 53b0dd6dc5957652f35964af16b892ec9af4a559.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar:

python import tensorflow as tf import numpy as np

tf.rawops.MapStage( key = tf.constant(value=[4], shape= (1,2), dtype=tf.int64), indices = np.array([[6]]), values = np.array([-60]), dtypes = [tf.int64], capacity=0, memorylimit=0, container='', sharedname='', name=None )

Patches We have patched the issue in GitHub commit f57315566d7094f322b784947093406c2aea0d7d.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia. ~

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug:

python import tensorflow as tf

tf.rawops.UnravelIndex(indices=-0x100000,dims=[0x100000,0x100000])

Patches We have patched the issue in GitHub commit 58b34c6c8250983948b5a781b426f6aa01fd47af. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:

python import tensorflow as tf

tf.rawops.StringNGrams( data=['123456'], datasplits=[0,1], separator='a'15, ngramwidths=[], leftpad='', rightpad='', padwidth=-5, preserveshortsequences=True)

We are missing a validation on padwitdh and that result in computing a negative value for ngramwidth which is later used to allocate parts of the output.

Patches We have patched the issue in GitHub commit f68fdab93fb7f4ddb4eb438c8fe052753c9413e8.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[2,2,2,2], outbackprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]], rowpoolingsequence=[-10,1,2,3], colpoolingsequence=[1,2,3,4], overlapping=True) return y test()

Patches We have patched the issue in GitHub commit 002408c3696b173863228223d535f9de72a101a9.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ConcatV2( values=[[1,2,3],[4,5,6]], axis = 0xb500005b) return y

test()

The axis argument is translated into concatdim in the ConcatShapeHelper helper function. Then, a value for minrank is computed based on concatdim. This is then used to validate that the values tensor has at least the required rank:

cc int64t concatdim; if (concatdimt->dtype() == DTINT32) { concatdim = staticcast<int64t>(concatdimt->flat<int32>()(0)); } else { concatdim = concatdimt->flat<int64t>()(0); }

// Minimum required number of dimensions. const int minrank = concatdim < 0 ? -concatdim : concatdim + 1;

// ... ShapeHandle input = c->input(endvalueindex - 1); TFRETURNIFERROR(c->WithRankAtLeast(input, minrank, &input));

However, WithRankAtLeast receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented:

cc Status InferenceContext::WithRankAtLeast(ShapeHandle shape, int64t rank, ShapeHandle out) { if (rank > kint32max) { return errors::InvalidArgument("Rank cannot exceed kint32max"); } // ... }

Due to the fact that minrank is a 32-bits value and the value of axis, the rank argument is a negative value, so the error check is bypassed.

Patches We have patched the issue in GitHub commit 08d7b00c0a5a20926363849f611729f53f3ec022.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0:

python import tensorflow as tf import numpy as np

tf.rawops.FractionalMaxPool( value=tf.constant(value=[[[[1, 4, 2, 3]]]], dtype=tf.int64), poolingratio=[1.0, 1.44, 1.73, 1.0], pseudorandom=False, overlapping=False, deterministic=False, seed=0, seed2=0, name=None)

Patches We have patched the issue in GitHub commit ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0:

python import tensorflow as tf

@tf.function def test(): y=tf.rawops.AvgPoolGrad( originputshape=[1,1,1,1], grad=[[[[1.0],[1.0],[1.0]]],[[[2.0],[2.0],[2.0]]],[[[3.0],[3.0],[3.0]]]], ksize=[1,1,1,1], strides=[1,1,1,0], padding='VALID', dataformat='NCHW') return y

test()

The function fails to check that the stride argument is stricly positive:

cc int64t GetOutputSize(const int64t input, const int64t filter, const int64t stride, const Padding& padding) { // Logic for calculating output shape is from GetWindowedOutputSizeVerbose() // function in thirdparty/tensorflow/core/framework/commonshapefns.cc. if (padding == Padding::VALID) { return (input - filter + stride) / stride; } else { // SAME. return (input + stride - 1) / stride; } }

Hence, the fix is to add a check for the stride argument to ensure it is valid.

Patches We have patched the issue in GitHub commit 3218043d6d3a019756607643cf65574fbfef5d7a.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.Dequantize( input=tf.constant([1,1],dtype=tf.qint32), minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: cc if (axis > -1) { numslices = input.dimsize(axis); } // ... int64t predim = 1, postdim = 1; for (int i = 0; i < axis; ++i) { predim = floatoutput.dimsize(i); } for (int i = axis + 1; i < floatoutput.dims(); ++i) { postdim = floatoutput.dimsize(i); } Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ReverseSequence( input = ['aaa','bbb'], seqlengths = [1,1,1], seqdim = -10, batchdim = -10 ) return y test()

There is a check to make sure the value of batchdim does not go over the rank of the input, but there is no check for negative values:

cc const int32t inputrank = c->Rank(input); if (batchdim >= inputrank) { return errors::InvalidArgument( "batchdim must be < input rank: ", batchdim, " vs. ", inputrank); } // ... DimensionHandle batchdimdim = c->Dim(input, batchdim); Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of Dim would access elements before the start of an array:

cc DimensionHandle Dim(ShapeHandle s, int64t idx) { if (!s.Handle() || s->rank == kUnknownRank) { return UnknownDim(); } return DimKnownRank(s, idx); } · static DimensionHandle DimKnownRank(ShapeHandle s, int64t idx) { CHECKNE(s->rank, kUnknownRank); if (idx < 0) { return s->dims[s->dims.size() + idx]; } return s->dims[idx]; }

Patches We have patched the issue in GitHub commit 37c01fb5e25c3d80213060460196406c43d31995.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:

python import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function def test(): y = tf.rawops.Dequantize( input=input, minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow:

cc int axis = -1; Status s = c->GetAttr("axis", &axis); // ... if (axis < -1) { return errors::InvalidArgument("axis should be at least -1, got ", axis); } // ... if (axis != -1) { ShapeHandle input; TFRETURNIFERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input)); // ... } Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel:

library { function { signature { name: "SomeOp" description: "Self recursive op" } nodedef { name: "1" op: "SomeOp" } nodedef { name: "2" op: "SomeOp" } } }

This would result in a stack overflow during execution as resolving each NodeDef means resolving the function itself and its nodes.

Patches We have patched the issue in GitHub commit 448a16182065bd08a202d9057dd8ca541e67996c.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes.

Patches We have patched the issue in GitHub commit 5b491cd5e41ad63735161cec9c2a568172c8b6a3. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).

In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the mktemp function usage.

Patches We have patched the issue in several commits, replacing mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.

Impact An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated.

Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes.

Patches We have patched the issue in GitHub commit 14fea662350e7c26eb5fe1be2ac31704e5682ee6.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Patches We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference:

cc string allowedgpus = flr->configproto()->gpuoptions().visibledevicelist(); In the default scenario, all devices are allowed, so flr->configproto is nullptr. Patches We have patched the issue in GitHub commit e21af685e1828f7ca65038307df5cc06de4479e8. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

Patches We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if (/ ... error conditions ... /) { png::CommonFreeDecode(&decode); OPREQUIRES(context, false, errors::InvalidArgument("PNG size too large for int: ", decode.width, " by ", decode.height)); } After png::CommonFreeDecode(&decode) gets called, the values of decode.width and decode.height are in an unspecified state.

Patches We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures.

cc int64t TensorByteSize(const TensorProto& t) { // numelements returns -1 if shape is not fully defined. int64t numelems = TensorShape(t.tensorshape()).numelements(); return numelems < 0 ? -1 : numelems DataTypeSize(t.dtype()); } TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow the size of an int. The PartialTensorShape constructor instead does not cause a CHECK-abort if the shape is partial, which is exactly what this function needs to be able to return -1.

Patches We have patched the issue in GitHub commit c2426bba00a01de6913738df8fa78e0215fcce02.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.