Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
433 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The implementation of division in TFLite is vulnerable to a division by 0 error There is no check that the divisor tensor does not contain zero elements. Patches We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data: If axis is a large negative value (e.g., -100000), then after the first if it would still be negative. The check following the if statement will pass and the for loop would read one element before the start of inputdims.data (when i = 0). Patches We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices. Similar issue exists in Gather implementation. Patches We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition: An attacker can craft a model such that ellipsisendidx is smaller than i (e.g., always negative). In this case, the inner loop does not increase i and the continue statement causes execution to skip over the preincrement at the end of the outer loop. Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. This is the only affected version. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.6.0rc2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: The implementation unconditionally dereferences a pointer. Patches We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements: Patches We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. Patches We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security…
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. There is no check that the first dimension of the input is non zero. Patches We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang of Baidu Security.
Recommended action: Upgrade to 2.5.1, 2.4.3 or 2.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. Patches We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22 (merging #50508). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version. For more information Please consult our security guide for more information regarding the security model and…
Recommended action: Upgrade to 2.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Passing invalid arguments (e.g., discovered via fuzzing) to tf.rawops.SparseCountSparseOutput results in segfault. Patches We have patched the issue in GitHub commit 82e6203221865de4008445b13c69b6826d2b28d9. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Passing a complex argument to tf.transpose at the same time as passing conjugate=True argument results in a crash: Patches We have received a patch for the issue in GitHub commit 1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported in #42105 and fixed in #46973.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments: Patches We have received a patch for the issue in GitHub commit 890f7164b70354c57d40eda52dcdd7658677c09f. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported in #46900 and fixed in #46974.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of TrySimplify has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs. Patches We have patched the issue in GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input. Patches We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of tf.io.decoderaw produces incorrect results and crashes the Python interpreter when combining fixedlength and wider datatypes. The implementation of the padded version is buggy due to a confusion about pointer arithmetic rules. First, the code computes the width of each output element by dividing the fixedlength value to the size of the type argument: The fixedlength argument is also used to determine the size needed for the output tensor: This is followed by reencoding code: The erroneous code is the last line above: it is moving the outdata pointer by fixedlength sizeof(T) bytes whereas it only copied at most fixedlength bytes from the input. This results in parts of the input not being decoded into the output. Furthermore, because the pointer advance is far wider than desired, this quickly leads to writing to outside the bounds of the backing data. This OOB write leads to interpreter crash in the reproducer mentioned here, but more severe attacks can be…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Incomplete validation in tf.rawops.CTCLoss allows an attacker to trigger an OOB read from heap: An attacker can also trigger a heap buffer overflow: Finally, an attacker can trigger a null pointer dereference: Patches We have patched the issue in GitHub commit14607c0707040d775e06b6817325640cb4b5864c followed by GitHub commit 4504a081af71514bb1828048363e6540f797005b. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a heap buffer overflow in Eigen implementation of tf.rawops.BandedTriangularSolve: The implementation calls ValidateInputTensors for input validation but fails to validate that the two tensors are not empty: Furthermore, since OPREQUIRES macro only stops execution of current function after setting ctx-status() to a non-OK value, callers of helper functions that use OPREQUIRES must check value of ctx-status() before continuing. This doesn't happen in this op's implementation, hence the validation that is present is also not effective. Patches We have patched the issue in GitHub commit ba6822bd7b7324ba201a28b2f278c29a98edbef2 followed by GitHub commit 0ab290774f91a23bebe30a358fde4e53ab4876a0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Incomplete validation in SparseReshape results in a denial of service based on a CHECK-failure. The implementation has no validation that the input arguments specify a valid sparse tensor. Patches We have patched the issue in GitHub commit 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The validation in tf.rawops.QuantizeAndDequantizeV2 allows invalid values for axis argument: The validation uses || to mix two different conditions: If axis < -1 the condition in OPREQUIRES will still be true, but this value of axis results in heap underflow. This allows attackers to read/write to other data on the heap. Patches We have patched the issue in GitHub commit c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Incomplete validation in SparseAdd results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data: The implementation has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of indices matches the size of corresponding shape. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation. Patches We have patched the issue in GitHub commit 6fd02f44810754ae7481838b6a67c5df7f909ca3 followed by GitHub commit 41727ff06111117bdf86b37db198217fd7a143cc. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to lack of validation in tf.rawops.RaggedTensorToTensor, an attacker can exploit an undefined behavior if input arguments are empty: The implementation only checks that one of the tensors is not empty, but does not check for the other ones. There are multiple DCHECK validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything. Patches We have patched the issue in GitHub commit b761c9b652af2107cfbc33efd19be0ce41daa33e followed by GitHub commit f94ef358bb3e91d517446454edff6535bcfe8e4a and GitHub commit c4d7afb6a5986b04505aca4466ae1951686c80f6. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of SplitV: If axisvalue is not a value between 0 and NumDimensions(input), then the SizeOfDimension function will access data outside the bounds of the tensor shape array: Patches We have patched the issue in GitHub commit ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issue: An attacker can craft a model such that the size multiplier is so large that the return value overflows the int datatype and becomes negative. In turn, this results in invalid value being given to malloc: In this case, ret-size would dereference an invalid pointer. Patches We have patched the issue in GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The TFLite implementation of hashtable lookup is vulnerable to a division by zero error: An attacker can craft a model such that values's first dimension would be 0. Patches We have patched the issue in GitHub commit 5117e0851348065ed59c991562c0ec80d9193db2. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.