Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
427 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and 3d89911481ba6ebe8c88c1c0b595412121e6c645. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. Patches We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode(..., &decode), the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode(&decode). However, several error case in the function implementation invoke the OPREQUIRES macro which immediately terminates the execution of the function, without allowing for the memory free to occur. Patches We have patched the issue in GitHub commit ab51e5b813573dc9f51efa335aebcf2994125ee9. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write: Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. Patches We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap: Patches We have patched the issue in GitHub commit 002408c3696b173863228223d535f9de72a101a9. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read: There is a check to make sure the value of batchdim does not go over the rank of the input, but there is no check for negative values: Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of Dim would access elements before the start of an array: Patches We have patched the issue in GitHub commit 37c01fb5e25c3d80213060460196406c43d31995. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This…
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow: Patches We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses: The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor: Patches We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that IsSimplifiableReshape would trigger CHECK failures. Patches We have patched the issue in GitHub commits ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1, 1fb27733f943295d874417630edd3b38b34ce082, and 240655511cd3e701155f944a972db71b6c0b1bb6. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.7.1, 2.6.3 or 2.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK (which is a no-op during production): An attacker can control inputidx such that ix would be larger than the number of values in nodet.args. Patches We have patched the issue in GitHub commit c99d98cd189839dcf51aee94e7437b54b31f8abd. The fix will be included in TensorFlow 2.8.0. This is the only affected version. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector. Patches We have patched the issue in GitHub commit 35f0fabb4c178253a964d7aabdbb15c6a398b69a. The fix will be included in TensorFlow 2.8.0. This is the only affected version. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases. Patches We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.…
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.math.segment operations results in a CHECK-fail related abort (and denial of service) if a segment id in segmentids is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using AddDim. However, if the number of elements in the tensor overflows an int64t value, AddDim results in a CHECK failure which provokes a std::abort. Instead, code should use AddDimWithStatus. Patches We have patched the issue in GitHub commit e9c81c1e1a9cd8dd31f4e83676cab61b60658429 (merging #51733). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and…
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative: This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. Patches We have patched the issue in GitHub commit 12b1ff82b3f26ff8de17e58703231d5a02ef1b8b (merging #51975). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an int64t. If an overflow occurs, MultiplyWithoutOverflow would return a negative result. In the majority of TensorFlow codebase this then results in a CHECK-failure. Newer constructs exist which return a Status instead of crashing the binary. For example AddDim calls should be replaced by AddDimWithStatus. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs). Patches We have patched the issue in GitHub commits 7c1692bd417eb4f9b33ead749a41166d6080af85 (merging #51732), d81b1351da3e8c884ff836b64458d94e4a157c15 (merging #51717), a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf (merging #51658), and d81b1351da3e8c884ff836b64458d94e4a157c15 (merging #51973). It is possible that other similar instances exist in TensorFlow, we will issue fixes as these…
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If tf.tile is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow. The number of elements in the output tensor is too much for the int64t type and the overflow is detected via a CHECK statement. This aborts the process. Patches We have patched the issue in GitHub commit 9294094df6fea79271778eb7e7ae1bad8b5ef98f (merging #51138). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If tf.image.resize is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow. The number of elements in the output tensor is too much for the int64t type and the overflow is detected via a CHECK statement. This aborts the process. Patches We have patched the issue in GitHub commit e5272d4204ff5b46136a1ef1204fc00597e21837 (merging #51497). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If tf.summary.createfilewriter is called with non-scalar arguments code crashes due to a CHECK-fail. Patches We have patched the issue in GitHub commit 874bda09e6702cd50bac90b453b50bcc65b2769e (merging #51715). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported externally via a GitHub issue.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact During execution, EinsumHelper::ParseEquation() is supposed to set the flags in inputhasellipsis vector and outputhasellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to true and never assigns false. This results in unitialized variable access if callers assume that EinsumHelper::ParseEquation() always sets these flags. Patches We have patched the issue in GitHub commit f09caa532b6e1ac8d2aa61b7832c78c5b79300c6. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact While calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition will be cast to double and the result would be truncated before the assignment. This result in overflows: Similarly, tf.range would result in crashes due to overflows if the start or end point are too large. Patches We have patched the issue in GitHub commits 6d94002a09711d297dbba90390d5482b76113899 (merging #51359) and 1b0e0ec27e7895b9985076eab32445026ae5ca94 (merging #51711). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been…
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. Patches We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact During TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. Patches We have patched the issue in GitHub commit 7731e8dfbe4a56773be5dc94d631611211156659. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The shape inference functions for the QuantizeAndDequantizeV operations can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: In all of these cases, axis is a negative value different than the special value used for optional/unknown dimensions (i.e., -1). However, the code ignores the occurences of these values: Patches We have patched the issue in GitHub commit 7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. Patches We have patched the issue in GitHub commits 68422b215e618df5ad375bcdc6d2052e9fd3080a, 4d74d8a00b07441cba090a02e0dd9ed385145bf4, 579261dcd446385831fe4f7457d802a59685121d, da4aad5946be30e5f049920fa076e1f7ef021261, 4dddb2fd0b01cdd196101afbba6518658a2c9e07, and e7f497570abb6b4ae5af4970620cd880e4c0c904. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still…
Recommended action: Upgrade to 2.6.1, 2.5.2 or 2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.