Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

Patches We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been patched in GitHub commit 4142e47e9e31db481781b955ed3ff807a781b494. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.

Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.

The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. Patches We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations:

cc int embeddingsize = 1; int lookupsize = 1; for (int i = 0; i < lookuprank - 1; i++, k++) { const int dim = denseshape->data.i32[i]; lookupsize = dim; outputshape->data[k] = dim; } for (int i = 1; i < embeddingrank; i++, k++) { const int dim = SizeOfDimension(value, i); embeddingsize = dim; outputshape->data[k] = dim; }

Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write. Patches We have patched the issue in GitHub commits f19be71717c497723ba0cea0379e84f061a75e01, 1de49725a5fc4e48f1a3b902ec3599ee99283043 and a4e401da71458d253b05e41f28637b65baf64be4.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Patches We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact TensorFlow is vulnerable to a heap OOB write in Grappler:

cc Status SetUnknownShape(const NodeDef node, int outputport) { shapeinference::ShapeHandle shape = GetUnknownOutputShape(node, outputport); InferenceContext ctx = GetContext(node); if (ctx == nullptr) { return errors::InvalidArgument("Missing context"); } ctx->setoutput(outputport, shape); return Status::OK(); }

The setoutput function writes to an array at the specified index:

cc void setoutput(int idx, ShapeHandle shape) { outputs.at(idx) = shape; }

Hence, this gives a malicious user a write primitive.

Patches We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:

python import tensorflow as tf import numpy as np

tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)

Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.Dequantize( input=tf.constant([1,1],dtype=tf.qint32), minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: cc if (axis > -1) { numslices = input.dimsize(axis); } // ... int64t predim = 1, postdim = 1; for (int i = 0; i < axis; ++i) { predim = floatoutput.dimsize(i); } for (int i = axis + 1; i < floatoutput.dims(); ++i) { postdim = floatoutput.dimsize(i); } Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:

python import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function def test(): y = tf.rawops.Dequantize( input=input, minrange=[1.0], maxrange=[10.0], mode='MINCOMBINED', narrowrange=False, axis=231-1, dtype=tf.bfloat16) return y

test()

The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow:

cc int axis = -1; Status s = c->GetAttr("axis", &axis); // ... if (axis < -1) { return errors::InvalidArgument("axis should be at least -1, got ", axis); } // ... if (axis != -1) { ShapeHandle input; TFRETURNIFERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input)); // ... } Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write:

cc for (int i = 0; i < opdef.outputargsize(); i++) { // ... for (int j = 0; j < t->argssize(); j++) { auto arg = t->mutableargs(i); // ... } }

Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

Patches We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect. If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:

cc TfLiteIntArray TfLiteIntArrayCreate(int size) { int allocsize = TfLiteIntArrayGetSizeInBytes(size); // ... TfLiteIntArray ret = (TfLiteIntArray)malloc(allocsize); // ... }

The TfLiteIntArrayGetSizeInBytes returns an int instead of a sizet:

cc int TfLiteIntArrayGetSizeInBytes(int size) { static TfLiteIntArray dummy;

int computedsize = sizeof(dummy) + sizeof(dummy.data[0]) size; #if defined(MSCVER) // Context for why this is needed is in http://b/189926408#comment21 computedsize -= sizeof(dummy.data[0]); #endif return computedsize; }

An attacker can control model inputs such that computedsize overflows the size of int datatype.

Patches We have patched the issue in GitHub commit a1e1511dde36b3f8aa27a6ec630838e7ea40e091.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.FractionalAvgPoolGrad( originputtensorshape=[2,2,2,2], outbackprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]], rowpoolingsequence=[-10,1,2,3], colpoolingsequence=[1,2,3,4], overlapping=True) return y test()

Patches We have patched the issue in GitHub commit 002408c3696b173863228223d535f9de72a101a9.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:

python import tensorflow as tf

@tf.function def test(): y = tf.rawops.ReverseSequence( input = ['aaa','bbb'], seqlengths = [1,1,1], seqdim = -10, batchdim = -10 ) return y test()

There is a check to make sure the value of batchdim does not go over the rank of the input, but there is no check for negative values:

cc const int32t inputrank = c->Rank(input); if (batchdim >= inputrank) { return errors::InvalidArgument( "batchdim must be < input rank: ", batchdim, " vs. ", inputrank); } // ... DimensionHandle batchdimdim = c->Dim(input, batchdim); Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of Dim would access elements before the start of an array:

cc DimensionHandle Dim(ShapeHandle s, int64t idx) { if (!s.Handle() || s->rank == kUnknownRank) { return UnknownDim(); } return DimKnownRank(s, idx); } · static DimensionHandle DimKnownRank(ShapeHandle s, int64t idx) { CHECKNE(s->rank, kUnknownRank); if (idx < 0) { return s->dims[s->dims.size() + idx]; } return s->dims[idx]; }

Patches We have patched the issue in GitHub commit 37c01fb5e25c3d80213060460196406c43d31995.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK (which is a no-op during production):

cc if (nodet.typeid() != TFTUNSET) { int ix = inputidx[i]; DCHECK(ix < nodet.argssize()) << "input " << i << " should have an output " << ix << " but instead only has " << nodet.argssize() << " outputs: " << nodet.DebugString(); inputtypes.emplaceback(nodet.args(ix)); // ... } An attacker can control inputidx such that ix would be larger than the number of values in nodet.args. Patches We have patched the issue in GitHub commit c99d98cd189839dcf51aee94e7437b54b31f8abd. The fix will be included in TensorFlow 2.8.0. This is the only affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's savedmodelcli tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. The maintainers have now removed the safe=False argument, so all parsing is done without calling eval. The patch is available in versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:

python import tensorflow as tf import numpy as np

tf.rawops.SparseTensorSliceDataset( indices=[[]], values=[], denseshape=[1,1])

The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.

Patches We have patched the issue in GitHub commit 965b97e4a9650495cda5a8c210ef6684b4b9eceb.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if (/ ... error conditions ... /) { png::CommonFreeDecode(&decode); OPREQUIRES(context, false, errors::InvalidArgument("PNG size too large for int: ", decode.width, " by ", decode.height)); } After png::CommonFreeDecode(&decode) gets called, the values of decode.width and decode.height are in an unspecified state.

Patches We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel:

library { function { signature { name: "SomeOp" description: "Self recursive op" } nodedef { name: "1" op: "SomeOp" } nodedef { name: "2" op: "SomeOp" } } }

This would result in a stack overflow during execution as resolving each NodeDef means resolving the function itself and its nodes.

Patches We have patched the issue in GitHub commit 448a16182065bd08a202d9057dd8ca541e67996c.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.

cc sizet maxRank = 0; for (auto shape : llvm::enumerate(shapes)) { auto foundshape = analysis.dimensionsForShapeTensor(shape.value()); if (!foundshape) return {}; shapesfound.pushback(foundshape); maxRank = std::max(maxRank, foundshape->size()); }

SmallVector<const ShapeComponentAnalysis::SymbolicDimension> joineddimensions(maxRank);

If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector.

Patches We have patched the issue in GitHub commit 35f0fabb4c178253a964d7aabdbb15c6a398b69a.

The fix will be included in TensorFlow 2.8.0. This is the only affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

TensorFlow is an open source platform for machine learning. If QuantizedMatMul is given nonscalar input for: mina, maxa, minb, or maxb It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit aca766ac7693bf29ed0df55ad6bfcc78f35e7f48. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. The implementation of AvgPoolGrad does not fully validate the input originputshape. This results in a CHECK failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. If QuantizedAdd is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. If QuantizedBiasAdd is given mininput, maxinput, minbias, maxbias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. If QuantizedAvgPool is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7cdf9d4d2083b739ec81cfdace546b0c99f50622. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

TensorFlow is an open source platform for machine learning. In core/kernels/listkernels.cc's TensorListReserve, numelements is assumed to be a tensor of size 1. When a numelements of more than 1 element is provided, then tf.rawops.TensorListReserve fails the CHECKEQ in CheckIsAlignedAndSingleElement. We have patched the issue in GitHub commit b5f6fbfba76576202b72119897561e3bd4f179c7. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.