Exploit for Deserialization of Untrusted Data in Google Tensorflow

CVE-2021-37678 Explo...

Security Bulletin: Multiple TensorFlow Vulnerabilities Affect IBM Watson Machine Learning on CP4D

Summary TensorFlow is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-29538 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by division by zero in Conv2DBackpropFilter. By sending a specially-crafted request, a...

Security Bulletin: Multiple TensorFlow Vulnerabilities Affect IBM Watson Machine Learning on CP4D

Summary TensorFlow is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-29608 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by a heap out-of-bounds and NULL pointer dereference flaw in "RaggedTensorToTensor". By...

Security Bulletin: Multiple TensorFlow Vulnerabilities Affect IBM Watson Machine Learning on CP4D

Summary TensorFlow is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-29547 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by heap out-of-bounds in QuantizedBatchNormWithGlobalNormalization. By sending a...

Google TensorFlow code issue vulnerability (CNVD-2022-09856)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that stems from the fact that when recovering a tensor via the raw API, TensorFlow may be tricked into referencing a null pointer if the...

Google TensorFlow code issue vulnerability (CNVD-2022-09857)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow is vulnerable to a code issue that arises from the fact that if the user does not provide a valid padding value for "tf.rawops.MatrixDiagPartOp", the code triggers a null point...

Heap out of bounds access in sparse reduction operations

Impact The implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data: python import tensorflow as tf x = tf.SparseTensor indices=773, 773, 773, 773, 773, 773, values=1, 1, denseshape=337, 337, 337 tf.sparse.reducesumx, 1 The...

GHSA-CGFM-62J4-V4RF Heap out of bounds access in sparse reduction operations

Impact The implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data: python import tensorflow as tf x = tf.SparseTensor indices=773, 773, 773, 773, 773, 773, values=1, 1, denseshape=337, 337, 337 tf.sparse.reducesumx, 1 The...

GHSA-HP4C-X6R7-6555 Floating point exception in `SparseDenseCwiseDiv`

Impact The implementation of tf.rawops.SparseDenseCwiseDiv is vulnerable to a division by 0 error: python import tensorflow as tf import numpy as np tf.rawops.SparseDenseCwiseDiv spindices=np.array4, spvalues=np.array-400, spshape=np.array647., dense=np.array0 The implementation uses a common cla...

Floating point exception in `SparseDenseCwiseDiv`

Impact The implementation of tf.rawops.SparseDenseCwiseDiv is vulnerable to a division by 0 error: python import tensorflow as tf import numpy as np tf.rawops.SparseDenseCwiseDiv spindices=np.array4, spvalues=np.array-400, spshape=np.array647., dense=np.array0 The implementation uses a common cla...

Null pointer dereference in `CompressElement`

Impact It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement: python import tensorflow as tf tf.rawops.CompressElementcomponents= The implementation was accessing the size of a buffer obtained from the return of a separate...

GHSA-HWR7-8GXX-FJ5P Null pointer dereference in `RaggedTensorToTensor`

Impact Sending invalid argument for rowpartitiontypes of tf.rawops.RaggedTensorToTensor API results in a null pointer dereference and undefined behavior: python import tensorflow as tf tf.rawops.RaggedTensorToTensor shape=1, values=10, defaultvalue=21, rowpartitiontensors=tf.constant0,0,0,0,...

Null pointer dereference in `RaggedTensorToTensor`

Impact Sending invalid argument for rowpartitiontypes of tf.rawops.RaggedTensorToTensor API results in a null pointer dereference and undefined behavior: python import tensorflow as tf tf.rawops.RaggedTensorToTensor shape=1, values=10, defaultvalue=21, rowpartitiontensors=tf.constant0,0,0,0,...

Null pointer dereference and heap OOB read in operations restoring tensors

Impact When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer: python import tensorflow as tf tf.rawops.Restore filepattern='/tmp', tensorname=, defaultvalue=21, dt=tf.int, preferredshard=1 The same undefined behavior c...

GHSA-95XM-G58G-3P88 Integer division by 0 in sparse reshaping

Impact The implementation of tf.rawops.SparseReshape can be made to trigger an integral division by 0 exception: python import tensorflow as tf tf.rawops.SparseReshape inputindices = np.ones1,3, inputshape = np.array1,1,0, newshape = np.array1,0 The implementation calls the reshaping functor...

Integer division by 0 in sparse reshaping

Impact The implementation of tf.rawops.SparseReshape can be made to trigger an integral division by 0 exception: python import tensorflow as tf tf.rawops.SparseReshape inputindices = np.ones1,3, inputshape = np.array1,1,0, newshape = np.array1,0 The implementation calls the reshaping functor...

Heap OOB in `RaggedGather`

Impact If the arguments to tf.rawops.RaggedGather don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. python import tensorflow as tf tf.rawops.RaggedGather paramsnestedsplits = 0,0,0, paramsdensevalues = 1,1, indices = 0,0,9,0,0,...

GHSA-9C8H-VVRJ-W2P8 Heap OOB in `RaggedGather`

Impact If the arguments to tf.rawops.RaggedGather don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. python import tensorflow as tf tf.rawops.RaggedGather paramsnestedsplits = 0,0,0, paramsdensevalues = 1,1, indices = 0,0,9,0,0,...

Division by 0 in `ResourceScatterDiv`

Impact The implementation of tf.rawops.ResourceScatterDiv is vulnerable to a division by 0 error: python import tensorflow as tf v= tf.Variable1,2,3 tf.rawops.ResourceScatterDiv resource=v.handle, indices=1, updates=0 The implementation uses a common class for all binary operations but fails to...

GHSA-CH4F-829C-V5PW Division by 0 in `ResourceScatterDiv`

Impact The implementation of tf.rawops.ResourceScatterDiv is vulnerable to a division by 0 error: python import tensorflow as tf v= tf.Variable1,2,3 tf.rawops.ResourceScatterDiv resource=v.handle, indices=1, updates=0 The implementation uses a common class for all binary operations but fails to...