Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

Patches We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.

Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.

Patches We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.

Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.

The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. Patches We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations:

cc int embeddingsize = 1; int lookupsize = 1; for (int i = 0; i < lookuprank - 1; i++, k++) { const int dim = denseshape->data.i32[i]; lookupsize = dim; outputshape->data[k] = dim; } for (int i = 1; i < embeddingrank; i++, k++) { const int dim = SizeOfDimension(value, i); embeddingsize = dim; outputshape->data[k] = dim; }

Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write. Patches We have patched the issue in GitHub commits f19be71717c497723ba0cea0379e84f061a75e01, 1de49725a5fc4e48f1a3b902ec3599ee99283043 and a4e401da71458d253b05e41f28637b65baf64be4.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Patches We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact TensorFlow is vulnerable to a heap OOB write in Grappler:

cc Status SetUnknownShape(const NodeDef node, int outputport) { shapeinference::ShapeHandle shape = GetUnknownOutputShape(node, outputport); InferenceContext ctx = GetContext(node); if (ctx == nullptr) { return errors::InvalidArgument("Missing context"); } ctx->setoutput(outputport, shape); return Status::OK(); }

The setoutput function writes to an array at the specified index:

cc void setoutput(int idx, ShapeHandle shape) { outputs.at(idx) = shape; }

Hence, this gives a malicious user a write primitive.

Patches We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:

python import tensorflow as tf import numpy as np

tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.Dequantize( input=tf.constant([1,1],dtype=tf.qint32), minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: cc if (axis > -1) { numslices = input.dimsize(axis); } // ... int64t predim = 1, postdim = 1; for (int i = 0; i < axis; ++i) { predim = floatoutput.dimsize(i); } for (int i = axis + 1; i < floatoutput.dims(); ++i) { postdim = floatoutput.dimsize(i); } Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:

python import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function def test(): y = tf.rawops.Dequantize( input=input, minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow:

cc int axis = -1; Status s = c->GetAttr("axis", &axis); // ... if (axis < -1) { return errors::InvalidArgument("axis should be at least -1, got ", axis); } // ... if (axis != -1) { ShapeHandle input; TFRETURNIFERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input)); // ... } Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write:

cc for (int i = 0; i < opdef.outputargsize(); i++) { // ... for (int j = 0; j < t->argssize(); j++) { auto arg = t->mutableargs(i); // ... } }

Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

Patches We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:

cc TfLiteIntArray TfLiteIntArrayCreate(int size) { int allocsize = TfLiteIntArrayGetSizeInBytes(size); // ... TfLiteIntArray ret = (TfLiteIntArray)malloc(allocsize); // ... }

The TfLiteIntArrayGetSizeInBytes returns an int instead of a sizet:

cc int TfLiteIntArrayGetSizeInBytes(int size) { static TfLiteIntArray dummy;

int computedsize = sizeof(dummy) + sizeof(dummy.data[0]) size; #if defined(MSCVER) // Context for why this is needed is in http://b/189926408#comment21 computedsize -= sizeof(dummy.data[0]); #endif return computedsize; }

An attacker can control model inputs such that computedsize overflows the size of int datatype.

Patches We have patched the issue in GitHub commit a1e1511dde36b3f8aa27a6ec630838e7ea40e091.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[2,2,2,2], outbackprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]], rowpoolingsequence=[-10,1,2,3], colpoolingsequence=[1,2,3,4], overlapping=True) return y test()

Patches We have patched the issue in GitHub commit 002408c3696b173863228223d535f9de72a101a9.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ReverseSequence( input = ['aaa','bbb'], seqlengths = [1,1,1], seqdim = -10, batchdim = -10 ) return y test()

There is a check to make sure the value of batchdim does not go over the rank of the input, but there is no check for negative values:

cc const int32t inputrank = c->Rank(input); if (batchdim >= inputrank) { return errors::InvalidArgument( "batchdim must be < input rank: ", batchdim, " vs. ", inputrank); } // ... DimensionHandle batchdimdim = c->Dim(input, batchdim); Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of Dim would access elements before the start of an array:

cc DimensionHandle Dim(ShapeHandle s, int64t idx) { if (!s.Handle() || s->rank == kUnknownRank) { return UnknownDim(); } return DimKnownRank(s, idx); } · static DimensionHandle DimKnownRank(ShapeHandle s, int64t idx) { CHECKNE(s->rank, kUnknownRank); if (idx < 0) { return s->dims[s->dims.size() + idx]; } return s->dims[idx]; }

Patches We have patched the issue in GitHub commit 37c01fb5e25c3d80213060460196406c43d31995.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The shape inference function for Transpose is vulnerable to a heap buffer overflow:

python import tensorflow as tf @tf.function def test(): y = tf.rawops.Transpose(x=[1,2,3,4],perm=[-10]) return y

test()

This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are all valid: cc for (int32t i = 0; i < rank; ++i) { int64t inidx = data[i]; if (inidx >= rank) { return errors::InvalidArgument("perm dim ", inidx, " is out of range of input rank ", rank); } dims[i] = c->Dim(input, inidx); }

where Dim(tensor, index) accepts either a positive index less than the rank of the tensor or the special value -1 for unknown dimensions.

Patches We have patched the issue in GitHub commit c79ba87153ee343401dbe9d1954d7f79e521eb14.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact During execution, EinsumHelper::ParseEquation() is supposed to set the flags in inputhasellipsis vector and outputhasellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output.

However, the code only changes these flags to true and never assigns false.

cc for (int i = 0; i < numinputs; ++i) { inputlabelcounts->at(i).resize(numlabels); for (const int label : inputlabels->at(i)) { if (label != kEllipsisLabel) inputlabelcounts->at(i)[label] += 1; else inputhasellipsis->at(i) = true; } } outputlabelcounts->resize(numlabels); for (const int label : outputlabels) { if (label != kEllipsisLabel) outputlabelcounts->at(label) += 1; else outputhasellipsis = true; }

This results in unitialized variable access if callers assume that EinsumHelper::ParseEquation() always sets these flags.

Patches We have patched the issue in GitHub commit f09caa532b6e1ac8d2aa61b7832c78c5b79300c6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr:

python import tensorflow as tf tf.rawops.SparseMatMul( a=[[1.0,1.0,1.0]], b=[[],[],[]], transposea=False, transposeb=False, aissparse=False, bissparse=True)

This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access.

Patches We have patched the issue in GitHub commit e6cf28c72ba2eb949ca950d834dd6d66bb01cfae.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow.

This is because the checkpoints loading infrastructure is missing validation for invalid file formats.

Patches We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible.

We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues.

Patches We have patched the issue in GitHub commits 68422b215e618df5ad375bcdc6d2052e9fd3080a, 4d74d8a00b07441cba090a02e0dd9ed385145bf4, 579261dcd446385831fe4f7457d802a59685121d, da4aad5946be30e5f049920fa076e1f7ef021261, 4dddb2fd0b01cdd196101afbba6518658a2c9e07, and e7f497570abb6b4ae5af4970620cd880e4c0c904.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. In the following scenario, this results in a crash:

python import tensorflow as tf @tf.function def test(): y = tf.ragged.cross([tf.ragged.constant([['1']]),'2']) return y test() Patches We have patched the issue in GitHub commit fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for the Cudnn operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow:

python import tensorflow as tf

@tf.function def func(): return tf.rawops.CudnnRNNV3( input=[0.1, 0.1], inputh=[0.5], inputc=[0.1, 0.1, 0.1], params=[0.5, 0.5], sequencelengths=[-1, 0, 1]) func() This occurs because the ranks of the input, inputh and inputc parameters are not validated, but code assumes they have certain values:

cc auto inputshape = c->input(0); auto inputhshape = c->input(1); auto seqlength = c->Dim(inputshape, 0); auto batchsize = c->Dim(inputshape, 1); // assumes rank >= 2 auto numunits = c->Dim(inputhshape, 2); // assumes rank >= 3

Patches We have patched the issue in GitHub commit af5fcebb37c8b5d71c237f4e59c6477015c78ce6.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings python def preprocessinputexprsargstring(inputexprsstr): ... for inputraw in filter(bool, inputexprsstr.split(';')): ... inputkey, expr = inputraw.split('=', 1) inputdict[inputkey] = eval(expr) ... This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a safe flag which defaults to True and an explicit warning for users.

Patches We have patched the issue in GitHub commit 8b202f08d52e8206af2bdb2112a62fafbc546ec7.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Omer Kaspi from Vdoo.

Impact TensorFlow's Grappler optimizer has a use of unitialized variable:

cc const NodeDef dequeuenode; for (const auto& trainnode : trainnodes) { if (IsDequeueOp(trainnode)) { dequeuenode = trainnode; break; } }

if (dequeuenode) { ... }

If the trainnodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeuenode is left unitialized.

Patches We have patched the issue in GitHub commit 68867bf01239d9e1048f98cbad185bf4761bedd3.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Qian Feng from Baidu Security Team.

Impact The async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free:

python import tensorflow as tf tf.rawops.CollectiveReduceV2( input=[], groupsize=[-10, -10, -10], groupkey=[-10, -10], instancekey=[-10], orderingtoken=[], mergeop='Mul', finalop='Div')

This occurs due to the asynchronous computation and the fact that objects that have been std::move()d from are still accessed:

cc auto donewithcleanup = colparams, done = std::move(done) { done(); colparams->Unref(); }; OPREQUIRESOKASYNC(c, FillCollectiveParams(colparams, REDUCTIONCOLLECTIVE, /groupsize/ c->input(1), /groupkey/ c->input(2), /instancekey/ c->input(3)), done);

Here, done is already moved from by the time OPREQUIRESOKASYNC macro needs to invoke it in case of errors. In this case, we get an undefined behavior, which can manifest via crashes, std::badalloc throws or just memory leaks.

Patches We have patched the issue in GitHub commit ca38dab9d3ee66c5de06f11af9a4b1200da5ef75.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:

python import tensorflow as tf import numpy as np

tf.rawops.SparseTensorSliceDataset( indices=[[]], values=[], denseshape=[1,1])

The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.

Patches We have patched the issue in GitHub commit 965b97e4a9650495cda5a8c210ef6684b4b9eceb.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if (/ ... error conditions ... /) { png::CommonFreeDecode(&decode); OPREQUIRES(context, false, errors::InvalidArgument("PNG size too large for int: ", decode.width, " by ", decode.height)); } After png::CommonFreeDecode(&decode) gets called, the values of decode.width and decode.height are in an unspecified state.

Patches We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel:

library { function { signature { name: "SomeOp" description: "Self recursive op" } nodedef { name: "1" op: "SomeOp" } nodedef { name: "2" op: "SomeOp" } } }

This would result in a stack overflow during execution as resolving each NodeDef means resolving the function itself and its nodes.

Patches We have patched the issue in GitHub commit 448a16182065bd08a202d9057dd8ca541e67996c.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of SparseBinCount is vulnerable to a heap OOB:

python import tensorflow as tf tf.rawops.SparseBincount( indices=[[0],[1],[2]] values=[0,-10000000] denseshape=[1,1] size=[1] weights=[3,2,1] binaryoutput=False)

This is because of missing validation between the elements of the values argument and the shape of the sparse output:

cc for (int64t i = 0; i < indicesmat.dimension(0); ++i) { const int64t batch = indicesmat(i, 0); const Tidx bin = values(i); ... out(batch, bin) = ...; }

Patches We have patched the issue in GitHub commit f410212e373eb2aec4c9e60bf3702eba99a38aba.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Impact The shape inference code for QuantizeV2 can trigger a read outside of bounds of heap allocated array:

python import tensorflow as tf

@tf.function def test(): data=tf.rawops.QuantizeV2( input=[1.0,1.0], minrange=[1.0,10.0], maxrange=[1.0,10.0], T=tf.qint32, mode='MINCOMBINED', roundmode='HALFTOEVEN', narrowrange=False, axis=-100, ensureminimumrange=10) return data

test()

This occurs whenever axis is a negative value less than -1. In this case, we are accessing data before the start of a heap buffer: cc int axis = -1; Status s = c->GetAttr("axis", &axis); if (!s.ok() && s.code() != error::NOTFOUND) { return s; } ... if (axis != -1) { ... TFRETURNIFERROR( c->Merge(c->Dim(minmax, 0), c->Dim(input, axis), &depth)); }

The code allows axis to be an optional argument (s would contain an error::NOTFOUND error code). Otherwise, it assumes that axis is a valid index into the dimensions of the input tensor. If axis is less than -1 then this results in a heap OOB read. Patches We have patched the issue in GitHub commit a0d64445116c43cf46a5666bd4eee28e7a82f244. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.