PT-2023-20232

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source platform for machine learning. The issue is a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is...

SUSE CVE-2021-41219

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

GHSA-689C-R7H2-FV9V TensorFlow vulnerable to segfault in `QuantizedMatMul`

Impact If QuantizedMatMul is given nonscalar input for: - mina - maxa - minb - maxb It gives a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 transposea = False transposeb = False Tactivation = tf.quint8 a = tf.constant7,...

CVE-2022-35973

TensorFlow is an open source platform for machine learning. If QuantizedMatMul is given nonscalar input for: mina, maxa, minb, or maxb It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit aca766ac7693bf29ed0df55ad6bfcc78f35e7f48. T...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google Inc. Google TensorFlow suffers from an input validation error vulnerability that originates from the fact that if the following non-scalar inputs are provided to QuantizedMatMul: mina, maxa, minb, or maxb, it...

PT-2022-23072

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 Description The issue arises when QuantizedMatMul is given nonscalar input for: min a, max a, min b, or max b. This can trigger a segfault, leading to a denial of...

Huawei MindSpore Community Concat Information Disclosure Vulnerability

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

CVE-2021-33648

CVE-2021-33648 affects Huawei MindSpore Community’s shape-inference logic for operators including Affine , Concat , MatMul , ArgMinMax , EmbeddingLookup , and Gather . When the input shape size is 0, the code may access data outside of the heap-allocated shape, causing an information-disclosure-t...

GHSA-XW93-V57J-FCGH Division by 0 in `SparseMatMul`

Impact An attacker can cause a denial of service via a FPE runtime error in tf.rawops.SparseMatMul: python import tensorflow as tf a = tf.constant100.0, 100.0, 100.0, 100.0, shape=2, 2, dtype=tf.float32 b = tf.constant, shape=0, 2, dtype=tf.float32 tf.rawops.SparseMatMul a=a, b=b, transposea=True...

CVE-2021-29557

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in tf.rawops.SparseMatMul. The division by 0 occurs deep in Eigen code because the b tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also...

CVE-2021-29557

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in tf.rawops.SparseMatMul. The division by 0 occurs deep in Eigen code because the b tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also...

PT-2021-18308 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: An attacker can cause a denial of service via a FPE runtime error in tf.raw ops.SparseMatMul...