Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
430 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes index is a scalar but there is no validation for this before accessing its value: Patches We have patched the issue in GitHub commit cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes handle is a scalar but there is no validation for this: Patches We have patched the issue in GitHub commit cff267650c6a1b266e4b4500f69fbc49cdd773c5. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes inputmin and inputmax are scalars but there is no validation for this. Patches We have patched the issue in GitHub commit 098e7762d909bac47ce1dbabe6dfd06294cb9d58. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes handle is a scalar but there is no validation for this: Patches We have patched the issue in GitHub commit 48305e8ffe5246d67570b64096a96f8e315a7281. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes axis is a scalar but there is no validation for this. Patches We have patched the issue in GitHub commit 290bb05c80c327ed74fae1d089f1001b1e2a4ef7. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University and Hong Jin from Singapore Management University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data: The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation. Patches We have patched the issue in GitHub commit ba6822bd7b7324ba201a28b2f278c29a98edbef2 followed by GitHub commit f6fde895ef9c77d848061c0517f19d0ec2682f3a. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved: If Tin and Tout don't match the type of data in out and input tensors then flat< would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a CHECK crash, hence a denial of service. Patches We have patched the issue in GitHub commit a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please…
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow the size of an int. The PartialTensorShape constructor instead does not cause a CHECK-abort if the shape is partial, which is exactly what this function needs to be able to return -1. Patches We have patched the issue in GitHub commit c2426bba00a01de6913738df8fa78e0215fcce02. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. Patches We have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: Here, we set item-kernel to nullptr but it is a simple OpKernel pointer so the memory that was previously allocated to it would leak. Patches We have patched the issue in GitHub commit c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements: Here, count and size can be large enough to cause count size to overflow. Patches We have patched the issue in GitHub commit fcd18ce3101f245b083b30655c27b239dc72221e. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: Here, we can have a large enough number of dimensions in outputshape.dim() or just a small number of dimensions being large enough to cause an overflow in the multiplication. Patches We have patched the issue in GitHub commit b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: Here, we have a nested map and we assume that if the first .find succeeds then so would be the search in the internal map. However, the maps are built based on the SavedModel protobuf format and a malicious user can alter that on disk before loading to cause the second .find to return nullptr. Patches We have patched the issue in GitHub commit 4f38b1ac8e42727e18a2f0bde06d3bee8e77b250. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: Patches We have patched the issue in GitHub commit ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: Patches We have patched the issue in GitHub commit f57315566d7094f322b784947093406c2aea0d7d. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia. ~
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: We are missing a validation on padwitdh and that result in computing a negative value for ngramwidth which is later used to allocate parts of the output. Patches We have patched the issue in GitHub commit f68fdab93fb7f4ddb4eb438c8fe052753c9413e8. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory: This is because the numthreads argument is only checked to not be negative, but there is no upper bound on its value. Patches We have patched the issue in GitHub commit e3749a6d5d1e8d11806d4a2e9cc3123d1a90b75e. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: The axis argument is translated into concatdim in the ConcatShapeHelper helper function. Then, a value for minrank is computed based on concatdim. This is then used to validate that the values tensor has at least the required rank: However, WithRankAtLeast receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented: Due to the fact that minrank is a 32-bits value and the value of axis, the rank argument is a negative value, so the error check is bypassed. Patches We have patched the issue in GitHub commit 08d7b00c0a5a20926363849f611729f53f3ec022. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information…
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: Patches We have patched the issue in GitHub commit 58b34c6c8250983948b5a781b426f6aa01fd47af. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The estimator for the cost of some convolution operations can be made to execute a division by 0: The function fails to check that the stride argument is stricly positive: Hence, the fix is to add a check for the stride argument to ensure it is valid. Patches We have patched the issue in GitHub commit 3218043d6d3a019756607643cf65574fbfef5d7a. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious user can cause a use after free behavior when decoding PNG images: After png::CommonFreeDecode(&decode) gets called, the values of decode.width and decode.height are in an unspecified state. Patches We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TensorFlow is vulnerable to a heap OOB write in Grappler: The setoutput function writes to an array at the specified index: Hence, this gives a malicious user a write primitive. Patches We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. Patches We have patched the issue in GitHub commit 14fea662350e7c26eb5fe1be2ac31704e5682ee6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the mktemp function usage. Patches We have patched the issue in several commits, replacing mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues…
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733). The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.