CVE-2022-35935 `CHECK` failure in `SobolSample` via missing validation in TensorFlow

TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. This issue has been patched in GitHub commit...

CVE-2022-35938 OOB read in `Gather_nd` op in TensorFlow Lite Micro

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been...

CVE-2022-35938

CVE-2022-35938 affects TensorFlow and TensorFlow Lite Micro GatherNd where inputs can trigger an out-of-bounds read or crash when sizes mismatch. The issue is patched in commit 4142e47e9e31db481781b955ed3ff807a781b494 and the fix will be included in TensorFlow 2.10.0, with cherry-picks to 2.9.1, ...

CVE-2022-35938 OOB read in `Gather_nd` op in TensorFlow Lite Micro

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been...

CVE-2022-35938 OOB read in `Gather_nd` op in TensorFlow Lite Micro

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been...

CVE-2022-35934

TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit...

CVE-2022-35934 `CHECK` failure in tf.reshape in Tensorflow

TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit...

CVE-2022-35934 `CHECK` failure in tf.reshape in Tensorflow

TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit...

CVE-2022-35934

CVE-2022-35934 : TensorFlow’s tf.reshape op is vulnerable to a denial of service caused by a CHECK-failure when overflowing the number of tensor elements. The issue is patched in commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555; the fix is planned for TensorFlow 2.10.0 and will be cherry-picked to...

CVE-2022-35934 `CHECK` failure in tf.reshape in Tensorflow

TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit...

TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf tf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string Patches We have patched the issue ...

GHSA-P7HR-F446-X6QF TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf tf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string Patches We have patched the issue ...

GHSA-37JF-MJV6-XFQW TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

Impact When Conv2DBackpropInput receives empty outbackprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np inputsizes = 3, 1, 1, 2 filter =...

TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

Impact When Conv2DBackpropInput receives empty outbackprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np inputsizes = 3, 1, 1, 2 filter =...

PT-2022-23082

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue arises from ParameterizedTruncatedNormal assuming shape is of type int3...

PT-2022-23067

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The implementation of AvgPoolGrad does not fully validate the input orig input...

PT-2022-23089

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description TensorFlow is an open source platform for machine learning. When TensorListScatte...

PT-2022-23095

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when the tf.sparse.cross function receives an input separator th...

Google TensorFlow 代码问题漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from a code issue vulnerability that stems from the fact that it crashes when mlir::tfg::TFOp::nameAttr receives an empty type list attribute. Th...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has an input validation error vulnerability that stems from the fact that the BlockLSTMGradV2 implementation does not fully validate its input, which could be exploited by an attacker to...