CVE-2021-41217

CVE-2021-41217 concerns TensorFlow: a null pointer dereference in the control-flow graph construction when paired nodes like Enter/Exit are not properly ordered. The vulnerability causes a crash due to dereferencing a null parent in the pairing logic. A fix is included in TensorFlow 2.7.0, with c...

CVE-2021-41217 Null pointer exception when `Exit` node is not preceded by `Enter` op

TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in th...

CVE-2021-41219

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

CVE-2021-41219

TensorFlow SparseMatMul contains undefined behavior by binding a reference to nullptr when either input dimension is 0 or less, risking heap OOB writes. The issue affects TensorFlow releases prior to the fix and is documented across multiple advisories (OSV, GHSA) with specific commit e6cf28c7 an...

CVE-2021-41219 Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

CVE-2021-41214 Reference binding to `nullptr` in `tf.ragged.cross`

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1,...

CVE-2021-41214

CVE-2021-41214 affects TensorFlow’s ragged.cross shape inference: binding a reference to nullptr causes undefined behavior. A fix is planned for TensorFlow 2.7.0, with cherry-picks to 2.6.1, 2.5.2, and 2.4.4 (still in supported range). Implication: vulnerable versions may crash or behave unexpect...

CVE-2021-41204 Segfault while copying constant resource tensor

TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in...

CVE-2021-41204

TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in...

CVE-2021-41204

CVE-2021-41204 concerns TensorFlow. In affected builds, during Grappler optimizer constant folding, a deep copy of a resource tensor may be attempted, causing a segfault because such tensors should not change. The issue is addressed with a fix in TensorFlow 2.7.0, and a cherry-pick was applied to...

CVE-2021-41226 Heap OOB read in `SparseBinCount`

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SparseBinCount is vulnerable to a heap OOB access. This is because of missing validation between the elements of the values argument and the shape of the sparse output. The fix will be included ...

CVE-2021-41226

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SparseBinCount is vulnerable to a heap OOB access. This is because of missing validation between the elements of the values argument and the shape of the sparse output. The fix will be included ...

CVE-2021-41226

TensorFlow SparseBinCount is affected by a heap out-of-bounds (OOB) access due to missing validation between the values and the sparse output shape. Reports in CVE-2021-41226 and related advisories identify this as the root cause in affected TF versions. The fix is planned for TensorFlow 2.7.0, w...

CVE-2021-41223 Heap OOB read in `FusedBatchNorm` kernels

TensorFlow is an open source platform for machine learning. In affected versions the implementation of FusedBatchNorm kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow...

CVE-2021-41223

TensorFlow is an open source platform for machine learning. In affected versions the implementation of FusedBatchNorm kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow...

CVE-2021-41223

CVE-2021-41223 describes a heap out-of-bounds (OOB) access in TensorFlow's FusedBatchNorm kernels in affected releases. The vulnerability affects the FusedBatchNorm implementation; the fix is planned for TensorFlow 2.7.0, with cherry-picks to 2.6.1, 2.5.2, and 2.4.4 (still in supported range). Mu...

CVE-2021-41224

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SparseFillEmptyRows can be made to trigger a heap OOB access. This occurs whenever the size of indices does not match the size of values. The fix will be included in TensorFlow 2.7.0. We will al...

CVE-2021-41224

TensorFlow SparseFillEmptyRows vulnerability (CVE-2021-41224): heap-based out-of-bounds access triggered when indices length does not match values length. Affected in TF versions before 2.7.0; fix included in TF 2.7.0 and cherry-picked to 2.6.1, 2.5.2, and 2.4.4. Remediation: upgrade to TF 2.7.0+...

CVE-2021-41224 `SparseFillEmptyRows` heap OOB read

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SparseFillEmptyRows can be made to trigger a heap OOB access. This occurs whenever the size of indices does not match the size of values. The fix will be included in TensorFlow 2.7.0. We will al...

CVE-2021-41212

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1,...