`CHECK`-failures in binary ops in Tensorflow

Impact A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that cas...

`CHECK`-failures in `TensorByteSize` in Tensorflow

Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. cc int64t TensorByteSizeconst TensorProto& t // numelements returns -1 if shape is not fully defined. int64t numelems = TensorShapet.tensorshape.numelements; retur...

`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow

Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. Patches We have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662. The fix will be included in...

Memory leak in Tensorflow

Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: cc Status s = params.createkerneln-properties, &item-kernel; if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a simp...

Integer overflow in Tensorflow

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for const auto& dim : outputshape.dim outputsize = dim.size; Here, we can have a...

Null-dereference in Tensorflow

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: cc const auto& initopsigit = metagraphdef.signaturedef.findkSavedModelInitOpSignatureKey; if initopsigit != sigdefmap.end initopname = initopsigit-second.outputs...

Division by zero in Tensorflow

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: python import tensorflow as tf import numpy as np tf.rawops.FractionalMaxPool value=tf.constantvalue=1, 4, 2, 3, dtype=tf.int64, poolingratio=1.0, 1.44, 1.73, 1.0, pseudorandom=False,...

`CHECK`-failures in Tensorflow

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: python import tensorflow as tf import numpy as np tf.rawops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

Memory exhaustion in Tensorflow

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: python import tensorflow as tf tf.rawops.StringNGrams data='123456', datasplits=0,1, separator='a'15, ngramwidths=, leftpad='', rightpad='',...

Memory exhaustion in Tensorflow

Impact The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory: python import tensorflow as tf y = tf.rawops.ThreadPoolHandlenumthreads=0x60000000,displayname='tf' This is because the numthreads argument is only checked to not be...

Type confusion leading to segfault in Tensorflow

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.rawops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argument...

Division by zero in Tensorflow

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0: python import tensorflow as tf @tf.function def test: y=tf.rawops.AvgPoolGrad originputshape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0, padding='VALID',...

Out of bounds write in Tensorflow

Impact TensorFlow is vulnerable to a heap OOB write in Grappler: cc Status SetUnknownShapeconst NodeDef node, int outputport shapeinference::ShapeHandle shape = GetUnknownOutputShapenode, outputport; InferenceContext ctx = GetContextnode; if ctx == nullptr return errors::InvalidArgument"Missing...

Integer overflow in Tensorflow

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 merging 51733. The fix will be included in...

Out of bounds write in TFLite

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. Patches We have patched t...

Integer overflow in TFLite

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations: cc int embeddingsize = 1; int lookupsize = 1; for int i = 0; i data.i32i; lookupsize = dim; outputshape-datak = dim; for int i = 1; i datak = dim; Both embeddingsize and lookupsize are...

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation: cc inline void BiasAndClampfloat clampmin, float clampmax, int biassize, const float biasdata, int arraysize, float arraydata // ... TFLITEDCHECKEQarraysize % biassize, 0; // ... Ther...

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added...

Heap overflow in Tensorflow

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow: python import tensorflow as tf import numpy as np tf.rawops.SparseCountSparseOutput indices=-1,-1, values=2, denseshape=1, 1, weights=1, binaryoutput=True, minlength=-1, maxlength=-1, name=None Patches We have...

Null pointer dereference in TensorFlow

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.rawops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, mininput = , maxinput = 1, ksize = 1, 1, 1, 1,...