GHSA-68V3-G9CM-RMM6 TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

Impact Out of bounds read in GRUBlockCellGrad python func = tf.rawops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'hprev': array136.5, 136.6, 'wru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'wc': array 0.4, 31.5, 0.6, 'bru': array0.1, 0.2 , dtype=float32, 'bc': 0x41414141, 'r': array0.3...

cifar-10-model (=7.4.0), gamornet-cpu (>=0.2.3 <=0.4.3) +8 more potentially affected by CVE-2023-25658 via tensorflow-cpu (>=1.15.0 <=2.11.0)

tensorflow-cpu PYPI version =1.15.0, =0.2.3, =0.0.5, =1.0.0, =1.8.2, =0.1.3, =0.3.0.dev221212, =0.7.0, =0.7.5 Source cves: CVE-2023-25658 Source advisory: OSV:GHSA-68V3-G9CM-RMM6...

TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

Impact Out of bounds read in GRUBlockCellGrad python func = tf.rawops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'hprev': array136.5, 136.6, 'wru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'wc': array 0.4, 31.5, 0.6, 'bru': array0.1, 0.2 , dtype=float32, 'bc': 0x41414141, 'r': array0.3...

PT-2023-20225

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description There is a heap buffer overflow in TAvgPoolGrad. The issue can be exploited by using the tf.raw ops.AvgPoolGrad function with specific parameters, such as ksize, strides, padding, data...

PT-2023-20218

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description TensorFlow, an open source platform for machine learning, has an issue where an out of bounds read occurs in GRUBlockCellGrad. The function tf.raw ops.GRUBlockCellGrad is affected, wit...

PT-2023-20237

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source machine learning platform. When running with XLA, tf.raw ops.Bincount segfaults when given a parameter weights that is neither the...

PT-2023-20238

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description The issue occurs when running TensorFlow with XLA, where tf.raw ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank...

PT-2023-20232

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source platform for machine learning. The issue is a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is...

PT-2023-20223

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description The issue is related to an integer overflow in the EditDistance function of TensorFlow, which can cause a deadlock when the hypothesis shape t is empty. This...

PT-2023-20226

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description The issue occurs when SparseSparseMaximum is given invalid sparse tensors as inputs, resulting in a null pointer error. This is a problem in the TensorFlow ope...

PT-2023-20221

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description The issue occurs when the parameter summarize of tf.raw ops.Print is zero, causing the new method SummarizeArray to reference a nullptr, leading to a seg fault...

PT-2023-20230

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue arises when the stride and window size are not positive for tf.raw ops.AvgPoolGrad, potentially causing a floating point exception. Recommendations For versions prior to...

PT-2023-21221

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12 TensorFlow version 2.11.1 and earlier Description Constructing a tflite model with a parameter filter input channel of less than 1 gives a Floating Point Exception FPE. This issue affects TensorFlow, an...

PT-2023-20236

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue is a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1. The error can be triggered by using the tf.raw ops.RandomShuffle...

PT-2023-20316

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue concerns the nn ops.fractional avg pool v2 and nn ops.fractional max pool v2 functions, which require the first and fourth elements of their pooling ratio parameter to be equ...

PT-2023-20228

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description Integer overflow occurs when 2^31 = num frames height width channels 2^32, for example, a Full HD screencast of at least 346 frames. This issue is related to the tf.io.decode gif...

PT-2023-20229

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source platform for machine learning. Attackers using TensorFlow can access heap memory which is not in the control of the user, leading ...

PT-2023-20224

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue occurs when ctx-step containter is a null pointer, causing the Lookup function to be executed with a null pointer. This can be triggered in certain scenarios, such as when...

PT-2023-20234

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11.1 TensorFlow versions prior to 2.12.0 Description The function tf.raw ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives a Null Pointer Exception NPE. TensorFlow is an open source...

PT-2023-20219

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue arises when the parameter indices for DynamicStitch does not match the shape of the parameter data, potentially triggering a stack OOB read. Recommendations For versions prio...