Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
433 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An attacker can trigger a division by 0 in tf.rawops.QuantizedMul: This is because the implementation does a division by a quantity that is controlled by the caller: Patches We have patched the issue in GitHub commit a1b11d2fdd1e51bfe18bb1ede804f60abfa92da6. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D: This is because the implementation does a division by a quantity that is controlled by the caller: Patches We have patched the issue in GitHub commit cfa91be9863a91d5105a3b4941096044ab32036b. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a division by 0 in tf.rawops.Conv2D: This is because the implementation does a division by a quantity that is controlled by the caller: Patches We have patched the issue in GitHub commit b12aa1d44352de21d1a6faaf04172d8c2508b42b. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropInput: This is because the implementation does a division by a quantity that is controlled by the caller: Patches We have patched the issue in GitHub commit 2be2cdf3a123e231b16f766aa0e27d56b4606535. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropFilter: This is because the implementation does a modulus operation where the divisor is controlled by the caller: Patches We have patched the issue in GitHub commit fca9874a9b42a2134f907d2fb46ab774a831404a. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.AddManySparseToTensorsMap: This is because the implementation takes the values specified in sparseshape as dimensions for the output shape: The TensorShape constructor uses a CHECK operation which triggers when InitDims returns a non-OK status. In our scenario, this occurs when adding a dimension from the argument results in overflow: This is a legacy implementation of the constructor and operations should use BuildTensorShapeBase or AddDimWithStatus to prevent CHECK-failures in the presence of overflows. Patches We have patched the issue in GitHub commit 69c68ecbb24dff3fa0e46da0d16c821a2dd22d7c. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The tf.rawops.Conv3DBackprop operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0: This is because the implementation does not check that the divisor used in computing the shard size is not zero: Thus, if attacker controls the input sizes, they can trigger a denial of service via a division by zero error. Patches We have patched the issue in GitHub commit 311403edbc9816df80274bd1ea8b3c0c0f22c3fa. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Specifying a negative dense shape in tf.rawops.SparseCountSparseOutput results in a segmentation fault being thrown out from the standard library as std::vector invariants are broken. This is because the implementation assumes the first element of the dense shape is always positive and uses it to initialize a BatchedMap<T (i.e., std::vector<absl::flathashmap<int64,T) data structure. If the shape tensor has more than one element, numbatches is the first value in shape. Ensuring that the denseshape argument is a valid tensor shape (that is, all elements are non-negative) solves this issue. Patches We have patched the issue in GitHub commit c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This…
Recommended action: Upgrade to 2.4.2 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Missing validation between arguments to tf.rawops.Conv3DBackprop operations can result in heap buffer overflows: This is because the implementation assumes that the input, filtersizes and outbackprop tensors have the same shape, as they are accessed in parallel. Patches We have patched the issue in GitHub commit 8f37b52e1320d8d72a9529b2468277791a261197. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our securityguide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The API of tf.rawops.SparseCross allows combinations which would result in a CHECK-failure and denial of service: The above code will result in a CHECK fail in tensor.cc: This is because the implementation is tricked to consider a tensor of type tstring which in fact contains integral elements: Fixing the type confusion by preventing mixing DTSTRING and DTINT64 types solves this issue. Patches We have patched the issue in GitHub commit b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference: The implementation dereferences the session state pointer without checking if it is valid: Thus, in eager mode, ctx-sessionstate() is nullptr and the call of the member function is undefined behavior. Patches We have patched the issue in GitHub commit ff70c47a396ef1e3cb73c90513da4f5cb71bebba. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious user could trigger a division by 0 in Conv3D implementation: The implementation does a modulo operation based on user controlled input: Thus, when filter has a 0 as the fifth element, this results in a division by 0. Additionally, if the shape of the two tensors is not valid, an Eigen assertion can be triggered, resulting in a program crash: The shape of the two tensors must follow the constraints specified in the op description. Patches We have patched the issue in GitHub commit 799f835a3dfa00a4d852defa29b15841eea9d64f. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Calling tf.rawops.RaggedTensorToVariant with arguments specifying an invalid ragged tensor results in a null pointer dereference: The implementation of RaggedTensorToVariant operations does not validate that the ragged tensor argument is non-empty: Since batchedragged contains no elements, batchedragged.splits is a null vector, thus batchedragged.splits(0) will result in dereferencing nullptr. Patches We have patched the issue in GitHub commit b055b9c474cd376259dde8779908f9eeaf097d93. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The implementation of MatrixDiag operations does not validate that the tensor arguments are non-empty: Thus, users can trigger null pointer dereferences if any of the above tensors are null: Changing from tf.rawops.MatrixDiagV2 to tf.rawops.MatrixDiagV3 still reproduces the issue. Patches We have patched the issue in GitHub commit a7116dd3913c4a4afd2a3a938573aa7c785fdfc6. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Ye Zhang and Yakun Zhang of Baidu X-Team.
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If the splits argument of RaggedBincount does not specify a valid SparseTensor, then an attacker can trigger a heap buffer overflow: This will cause a read from outside the bounds of the splits tensor buffer in the implementation of the RaggedBincount op: Before the for loop, batchidx is set to 0. The attacker sets splits(0) to be 7, hence the while loop does not execute and batchidx remains 0. This then results in writing to out(-1, bin), which is before the heap allocated buffer for the output tensor. Patches We have patched the issue in GitHub commit eebb96c2830d48597d055d247c0e9aebaea94cd5. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from…
Recommended action: Upgrade to 2.4.2 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. There are multiple ways to reproduce this, listing a few examples here: All these examples and similar ones have the same behavior: the conversion from Python array to C++ array is vulnerable to a type confusion: For the tensor types involved in the above example, the pyarraytype is NPYVOID but the descr field is such that descr-field = NULL. Then PyArrayDescrtoTFDataType will trigger a null dereference: This is because the Python's PyDictNext implementation would dereference the first argument. Patches We have patched the issue in GitHub commit 030af767d357d1b4088c4a25c72cb3906abac489. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our…
Recommended action: Upgrade to 2.4.2, 2.3.3, 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If the splits argument of RaggedBincount does not specify a valid SparseTensor, then an attacker can trigger a heap buffer overflow: This will cause a read from outside the bounds of the splits tensor buffer in the implementation of the RaggedBincount op: Before the for loop, batchidx is set to 0. The user controls the splits array, making it contain only one element, 0. Thus, the code in the while loop would increment batchidx and then try to read splits(1), which is outside of bounds. Patches We have patched the issue in GitHub commit eebb96c2830d48597d055d247c0e9aebaea94cd5. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.4.2 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by outputindex) and the input slot of the dst node (given by inputindex). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality: However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. Patches We have patched the issue in GitHub commit 0cc38aaa4064fd9e79101994ce9872c6d91f816b and will release TensorFlow 2.4.0 containing the patch.…
Recommended action: Upgrade to 2.3.2, 2.2.2, 2.1.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. Patches We have patched the issue in GitHub commit 14755416e364f17fb1870882fa778c7fec7f16e3 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.3.2, 2.2.2, 2.1.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the alocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overriden. Patches We have patched the issue in GitHub commit c1e1fc899ad5f8c725dcbb6470069890b5060bc7 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and…
Recommended action: Upgrade to 2.3.2, 2.2.2, 2.1.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The tf.rawops.DataFormatVecPermute API does not validate the srcformat and dstformat attributes. The code assumes that these two arguments define a permutation of NHWC. However, these assumptions are not checked and this can result in uninitialized memory accesses, read outside of bounds and even crashes. A similar issue occurs in tf.rawops.DataFormatDimMap, for the same reasons: Patches We have patched the issue in GitHub commit ebc70b7a592420d3d2f359e4b1694c236b82c7ae and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Recommended action: Upgrade to 2.3.2, 2.2.2, 2.1.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Under certain cases, a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen: Patches We have patched the issue in GitHub commit ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Recommended action: Upgrade to 2.3.2, 2.2.2, 2.1.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When the boxes argument of tf.image.cropandresize has a very large value, the CPU kernel implementation receives it as a C++ nan floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. Patches We have patched the issue in c0319231333f0f16e1cc75ec83660b01fedd4182 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported in #42129
Recommended action: Upgrade to 2.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize: This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation: However, dimsize only does a DCHECK to validate the argument and then uses it to access the corresponding element of an array: Since in normal builds, DCHECK-like macros are no-ops, this results in segfault and access out of bounds of the array. Patches We have patched the issue in eccb7ec454e6617738554a255d77f08e60ee0808 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported in #42105
Recommended action: Upgrade to 2.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/referenceops.h#L2625-L2631 Users having access to segmentidsdata can alter outputindex and then write to outside of outputdata buffer. This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits. Patches We have patched the issue in 204945b and will release patch releases for all affected versions. We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1. Workarounds A potential workaround would be to add a custom Verifier to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored…
Recommended action: Upgrade to 2.3.1 or 2.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.