CVE-2021-29561 CHECK-fail in `LoadAndRemapMatrix`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from tf.rawops.LoadAndRemapMatrix. This is because the...

CVE-2021-29561

CVE-2021-29561 (TensorFlow) describes a denial-of-service via a CHECK-fail in LoadAndRemapMatrix caused by assuming ckpt_path is a valid scalar; attackers can send a non-scalar tensor as the first argument. Connected docs confirm the same issue and note fixes will be applied in TensorFlow 2.5.0 w...

CVE-2021-29562

TensorFlow TF IRFFT CHECK-fail vulnerability (CVE-2021-29562) can cause denial of service via a CHECK failure in tf.raw_ops.IRFFT. Public details in OSV/GHSA entries confirm impact and patch strategy: fix in TensorFlow 2.5.0, with cherry-picks to 2.4.2, 2.3.3, 2.2.3 and 2.1.4. IBM CVE coverage an...

CVE-2021-29562 CHECK-fail in `tf.raw_ops.IRFFT`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from the implementation of tf.rawops.IRFFT. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2,...

CVE-2021-29562

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from the implementation of tf.rawops.IRFFT. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2,...

CVE-2021-29563

CVE-2021-29563 affects TensorFlow via a CHECK-fail in tf.raw_ops.RFFT that can trigger a denial of service when Eigen code operates on an empty matrix. The issue arises from a CHECK/ASSERT path and causes program termination rather than a traditional memory corruption exploit. The affected behavi...

CVE-2021-29563 CHECK-fail in `tf.raw_ops.RFFT`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from the implementation of tf.rawops.RFFT. Eigen code operating on an empty matrix can trigger on an assertion and will cause program termination...

CVE-2021-29563

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a CHECK-failure coming from the implementation of tf.rawops.RFFT. Eigen code operating on an empty matrix can trigger on an assertion and will cause program termination...

CVE-2021-29564 Null pointer dereference in `EditDistance`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.EditDistance. This is because the...

CVE-2021-29564

TensorFlow vulnerability CVE-2021-29564: a null pointer dereference in tf.raw_ops.EditDistance due to incomplete input parameter validation in the EditDistance kernel (edit_distance_op.cc). Impact is a potential crash/crash-like denial of service; fix is committed and will be in TensorFlow 2.5.0 ...

CVE-2021-29564

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.EditDistance. This is because the...

CVE-2021-29565 Null pointer dereference in `SparseFillEmptyRows`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.SparseFillEmptyRows. This is because of missing...

CVE-2021-29565

TensorFlow CVE-2021-29565 describes a null pointer dereference in tf.raw_ops.SparseFillEmptyRows due to missing validation when dense_shape is empty. Connected sources confirm the issue, including a GitHub commit (faa76f39014ed3b5e2c158593b1335522e573c7f) and notes that the fix will be included i...

CVE-2021-29566

TensorFlow is an end-to-end open source platform for machine learning. An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.rawops.Dilation2DBackpropInput. This is because the...

CVE-2021-29566 Heap OOB access in `Dilation2DBackpropInput`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.rawops.Dilation2DBackpropInput. This is because the...

CVE-2021-29566

TensorFlow: CVE-2021-29566 is a heap-out-of-bounds (OOB) access in tf.raw_ops.Dilation2DBackpropInput due to missing input validation. This can cause writes outside the heap during backprop, as per the OSV/GHSA entries. The issue is fixed in TensorFlow 2.5.0 with cherry-picks to 2.4.2, 2.3.3, 2.2...

CVE-2021-29567 Lack of validation in `SparseDenseCwiseMul`

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.SparseDenseCwiseMul, an attacker can trigger denial of service via CHECK-fails or accesses to outside the bounds of heap allocated data. Since the...

CVE-2021-29567

TensorFlow vulnerability CVE-2021-29567: SparseDenseCwiseMul lacks validation between input dimensions, only validating input ranks. This enables local attackers to trigger CHECK failures or heap-out-of-bounds writes, causing denial of service. Affected TF versions include 2.5.0 and older release...

CVE-2021-29568

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in tf.rawops.ParameterizedTruncatedNormal. This is because the...

CVE-2021-29568

TensorFlow vulnerability CVE-2021-29568 arises from binding to a NULL pointer in tf.raw_ops.ParameterizedTruncatedNormal due to not validating the shape argument before accessing shape_tensor.flat(0). The issue can cause undefined behavior; the affected commits patch the input validation. A fix w...