PT-2021-21800 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4 Description: The implementation of SVDF in TFLite is vulnerable to a null pointer error. The GetVariableInput function can return a...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source machine learning platform. a security vulnerability exists in Google TensorFlow TFLite. A local attacker can exploit this vulnerability to cause a denial of service condition...

Google TensorFlow 安全漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow TFLite. An attacker can exploit the vulnerability to cause a denial of service...

PT-2021-21811 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: An attacker can craft a TFLite model that would trigger a division by zero error...

PT-2021-21804 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The issue is related to TensorFlow's TFLite, where the expand dims.cc file...

PT-2021-21805 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow version 2.6.0 Description: The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition. An attacker c...

PT-2021-21802 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4 Description: The implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in Google TensorFlow TFLite. A local attacker can exploit this vulnerability to cause a denial of service condition...

PT-2021-21801 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The issue affects all TFLite operations that use quantization, allowing them to...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from the fact that the SVDF implementation in TFLite is vulnerable to a null pointer error in the affected version. An attacker could...

GHSA-8RM6-75MF-7R7R Division by zero in TFLite's implementation of hashtable lookup

Impact The TFLite implementation of hashtable lookup is vulnerable to a division by zero error: cc const int numrows = SizeOfDimensionvalue, 0; const int rowbytes = value-bytes / numrows; An attacker can craft a model such that values's first dimension would be 0. Patches We have patched the issu...

GHSA-CRCH-J389-5F84 Heap OOB write in TFLite

Impact A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of ArgMin/ArgMax: cc TfLiteIntArray outputdims = TfLiteIntArrayCreateNumDimensionsinput - 1; int j = 0; for int i = 0; i dataj = SizeOfDimensioninput, i; ++j; If axisvalue is not a value betwee...

GHSA-RF3H-XGV5-2Q39 Division by zero in TFLite's implementation of `DepthwiseConv`

Impact The implementation of the DepthwiseConv TFLite operator is vulnerable to a division by zero error: cc int numinputchannels = SizeOfDimensioninput, 3; TFLITEENSUREEQcontext, numfilterchannels % numinputchannels, 0; An attacker can craft a model such that input's fourth dimension would be 0...

GHSA-9C84-4HX6-XMM4 Integer overflow in TFLite concatentation

Impact The TFLite implementation of concatenation is vulnerable to an integer overflow issue: cc for int d = 0; d dims-size; ++d if d == axis sumaxis += t-dims-dataaxis; else TFLITEENSUREEQcontext, t-dims-datad, t0-dims-datad; An attacker can craft a model such that the dimensions of one of the...

GHSA-J8QH-3XRQ-C825 Division by zero in TFLite's implementation of `OneHot`

Impact The implementation of the OneHot TFLite operator is vulnerable to a division by zero error: cc int prefixdimsize = 1; for int i = 0; i dims-datai; const int suffixdimsize = NumElementsopcontext.indices / prefixdimsize; An attacker can craft a model such that at least one of the dimensions ...

GHSA-97WF-P777-86JQ Division by zero in TFLite's implementation of Split

Impact The implementation of the Split TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREMSGcontext, inputsize % numsplits == 0, "Not an even split"; const int slicesize = inputsize / numsplits; An attacker can craft a model such that numsplits would be 0. Patches We have...

GHSA-PMPR-55FJ-R229 Division by zero in TFLite's implementation of `SVDF`

Impact The implementation of the SVDF TFLite operator is vulnerable to a division by zero error: cc const int rank = params-rank; ... TFLITEENSUREEQcontext, numfilters % rank, 0; An attacker can craft a model such that params-rank would be 0. Patches We have patched the issue in GitHub commit...

GHSA-V52P-HFJF-WG88 Division by zero in TFLite's implementation of `SpaceToBatchNd`

Impact The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, finaldimsize % blockshapedim, 0; outputsize-datadim + 1 = finaldimsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is ...

GHSA-4VRF-FF7V-HPGR Division by zero in TFLite's implementation of `EmbeddingLookup`

The implementation of the EmbeddingLookup TFLite operator is vulnerable to a division by zero error: cc const int rowsize = SizeOfDimensionvalue, 0; const int rowbytes = value-bytes / rowsize; An attacker can craft a model such that the first dimension of the value input is 0. Patches We have...

GHSA-VF94-36G5-69V8 Division by zero in TFLite's implementation of `DepthToSpace`

Impact The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero error: cc const int blocksize = params-blocksize; ... const int inputchannels = input-dims-data3; ... int outputchannels = inputchannels / blocksize / blocksize; An attacker can craft a model such th...