Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
427 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. Patches We have patched the issue in GitHub commit 83dcb4dbfa094e33db084e97c4d0531a559e0ebf. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Kang Hong Jin.
Recommended action: Upgrade to 2.9.1, 2.8.1 or 2.7.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When Conv2DBackpropInput receives empty outbackprop inputs (e.g. [3, 1, 0, 1]), the current CPU/GPU kernels CHECK fail (one with dnnl, the other with cudnn). This can be used to trigger a denial of service attack. Patches We have patched the issue in GitHub commit 27a65a43cf763897fecfa5cdb5cc653fc5dd0346. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Jingyi Shi.
Recommended action: Upgrade to 2.9.1, 2.8.1 or 2.7.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor: This is another instance of TFSA-2021-198 (CVE-2021-41197). Patches We have patched the issue in GitHub commit 3796cc4fcd93ae55812a457abc96dcd55fbb854b. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection: This can be used to open a reverse shell This is because the fix for CVE-2021-41228 was incomplete. Under certain code paths it still allows unsafe execution: This code path was maintained for compatibility reasons as we had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. We have now removed the safe=False argument, so all parsing is done withough calling eval. Patches We have patched the issue in GitHub commit c5da7af048611aa29e9382371f0aed5018516cac. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.…
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures). Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 (merging GitHub PR #55274). The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling QuantizeMultiplierSmallerThanOneExp, the TFLITECHECKLT assertion would trigger and abort the process. Patches We have patched the issue in GitHub commit a989426ee1346693cc015792f11d715f6944f2b8. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements: The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index: If values contains NaN then the result of the division is still NaN and the cast to int32 would result in a crash. This only occurs on the CPU implementation. Patches We have patched the issue in GitHub commit e57fd691c7b0fd00ea3bfe43444f30c1969748b5. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The TensorKey hash function used total estimated AllocatedBytes(), which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. int32t). It also tried to access individual tensor bytes through tensor.data() of size AllocatedBytes(). This led to ASAN failures because the AllocatedBytes() is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the .data() buffer. We couldn't use this byte vector anyways, since types like tstring include pointers, whereas we need to hash the string values themselves. Patches We have patched the issue in GitHub commit 1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, which is the only other affected version. For more information Please consult our security guide for more information regarding the security model and how to contact us…
Recommended action: Upgrade to 2.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The macros that TensorFlow uses for writing assertions (e.g., CHECKLT, CHECKGT, etc.) have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit b917181c29b50cb83399ba41f4d938dc369109a1 (merging GitHub PR #55730). The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: In multiple places throughout the code, we are computing an index for a write operation: However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for loc. Patches We have patched the issue in GitHub commit 30721cf564cb029d34535446d6a5a6357bebc8e7. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown…
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid: In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Patches We have patched the issue in GitHub commit a5b89cd68c02329d793356bda85d079e9e69b4e7 and GitHub commit dbdd98c37bc25249e8f288bd30d01e118a7b4498. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Hong Jin from Singapore…
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments: In this case, a reference gets bound to a nullptr during kernel execution. This is UB. Patches We have patched the issue in GitHub commit 11ced8467eccad9c7cb94867708be8fa5c66c730. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types (added after migration to TF 2.x): In these scenarios, since the kernel is missing, a nullptr value is passed to ParseDimensionValue for the pyvalue argument. Then, this is dereferenced, resulting in segfault. Patches We have patched the issue in GitHub commit 237822b59fc504dda2c564787f5d3ad9c4aa62d9. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Hong Jin from Singapore Management University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes numsegments is a positive scalar but there is no validation: Since this value is used to allocate the output tensor, a negative value would result in a CHECK-failure (assertion failure), as per TFSA-2021-198. Patches We have patched the issue in GitHub commit 84563f265f28b3c36a15335c8b005d405260e943 and GitHub commit 20cb18724b0bf6c09071a3f53434c4eec53cc147. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub…
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.SpaceToBatchND (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a CHECK-failure (assertion failure), as in TFSA-2021-198. Patches We have patched the issue in GitHub commit acd56b8bcb72b163c834ae4f18469047b001fadf. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory: Patches We have patched the issue in GitHub commit bd4d5583ff9c8df26d47a23e508208844297310e. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.QuantizedConv2D does not fully validate the input arguments: In this case, references get bound to nullptr for each argument that is empty (in the example, all arguments in the bad args section). Patches We have patched the issue in GitHub commit 0f0b080ecde4d3dfec158d6f60da34d5e31693c4. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code does not validate the ranks of any of the arguments to this API call. This results in CHECK-failures when the elements of the tensor are accessed. Patches We have patched the issue in GitHub commit 803404044ae7a1efac48ba82d74111fce1ddb09a. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes initializingvalues is a vector but there is no validation for this before accessing its value: Patches We have patched the issue in GitHub commit 3150642acbbe254e3c3c5d2232143fa591855ac9. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes denseshape is a vector and indices is a matrix (as part of requirements for sparse tensors) but there is no validation for this: Patches We have patched the issue in GitHub commit ea50a40e84f6bff15a0912728e35b657548cef11. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes numsegments is a scalar but there is no validation for this before accessing its value: Patches We have patched the issue in GitHub commit 13d38a07ce9143e044aa737cfd7bb759d0e9b400. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code does not validate that the filtersizes argument is a vector. Patches We have patched the issue in GitHub commit 174c5096f303d5be7ed2ca2662b08371bff4ab88. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes index is a scalar but there is no validation for this before accessing its value: Patches We have patched the issue in GitHub commit cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes handle is a scalar but there is no validation for this: Patches We have patched the issue in GitHub commit cff267650c6a1b266e4b4500f69fbc49cdd773c5. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: The code assumes inputmin and inputmax are scalars but there is no validation for this. Patches We have patched the issue in GitHub commit 098e7762d909bac47ce1dbabe6dfd06294cb9d58. The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Recommended action: Upgrade to 2.8.1, 2.7.2 or 2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.