Google TensorFlow buffer overflow vulnerability (CNVD-2021-87050)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google TensorFlow is vulnerable to a buffer overflow vulnerability that stems from Transpose's shape inference function being vulnerable to a heap buffer overflow. No details of the vulnerability are...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service attacks. The vulnerability exists in 'ValidateAndCreateOutput' of 'imageresizerstate.h' due to lack of validation. Large input arguments result in large number of elements in the output tensor causes an overflow resulting an application crash...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service attacks. The vulnerability exists because 'CopyDataFromTensorSliceToTensorSlice' is not properly validated. An attacker is able to cause a buffer overflow by changing the saved checkpoints from outside the TensorFlow which results in an application...

Unitialized Variable Access

tensorflow is vulnerable to unitialized variable access. Flags inside EinsumHelper::ParseEquation function only changes to true and never assigns false resulting in unitialized variable access if callers assume that the function always sets these flags...

Command Injection

tensorflow is vulnerable to command injection. An attacker can inject and execute malicious commands via the savedmodelcli.py when it calls the eval on user-supplied strings...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. The library does not properly implement the tf.math.segment operations, allowing an attacker to crash the application by providing large segmentids...

Google TensorFlow null pointer dereference vulnerability (CNVD-2021-85888)

Google TensorFlow, an end-to-end open source machine learning platform, is vulnerable to a null pointer dereference in the shape inference code of DeserializeSparse in versions of TensorFlow prior to 2.7.0. The vulnerability stems from the shape inference function assuming that the serializespars...

Google TensorFlow Heap Out-of-Bounds Access Vulnerability (CNVD-2021-85882)

Google TensorFlow is an end-to-end open source machine learning platform. a heap out-of-bounds access vulnerability exists in the SparseFillEmptyRows implementation in versions prior to TensorFlow 2.7.0. No details of the vulnerability are currently available...

Google TensorFlow heap allocation array out-of-bounds read vulnerability (CNVD-2021-85885)

Google TensorFlow is an end-to-end open source machine learning platform. An out-of-bounds read vulnerability exists in the shape inference code of tf.ragged.cross in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No details of the vulnerability are currently available...

Google TensorFlow heap out-of-bounds access vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. a heap out-of-bounds access vulnerability exists in the implementation of the FusedBatchNorm kernel in versions prior to TensorFlow 2.7.0. No details of the vulnerability are currently available...

Google TensorFlow Heap Out-of-Bounds Access Vulnerability (CNVD-2021-85883)

Google TensorFlow, an end-to-end open source machine learning platform, suffers from a heap out-of-bounds access vulnerability in the SparseBinCount implementation in versions prior to TensorFlow 2.7.0. The vulnerability stems from missing validation between the elements of the values parameter a...

Google TensorFlow heap allocation array out-of-bounds read vulnerability (CNVD-2021-85884)

Google TensorFlow is an end-to-end open source machine learning platform. an out-of-bounds read vulnerability exists in the shape inference function of SparseCountSparseOutput in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No detailed vulnerability details are currently availab...

Google TensorFlow heap allocation array out-of-bounds read vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. an out-of-bounds read vulnerability exists in the shape inference function of the QuantizeAndDequantizeV operation in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No detailed vulnerability details are...

CVE-2021-41220

TensorFlow is an open source platform for machine learning. In affected versions the async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been std::moved from are still...

CVE-2021-41225

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the trainnodes vector obtained from the saved model that gets optimized does not contain a Dequeue node, then dequeuenode is left unitialized. The...

CVE-2021-41216

TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for Transpose is vulnerable to a heap buffer overflow. This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are al...

CVE-2021-41228

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's savedmodelcli tool is vulnerable to a code injection as it calls eval on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given...

CVE-2021-41227

TensorFlow is an open source platform for machine learning. In affected versions the ImmutableConst operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the tstring TensorFlow string class has a special case for memory mapped strings but the operation...

CVE-2021-41222

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SplitV can trigger a segfault is an attacker supplies negative arguments. This occurs whenever sizesplits contains more than one value and at least one value is negative. The fix will be include...

CVE-2021-41221

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the Cudnn operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the input, inputh and inputc parameters are n...