9218 matches found
Incomplete validation in `QuantizeV2`
Impact Due to incomplete validation in tf.rawops.QuantizeV2, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays: python import tensorflow as tf tf.rawops.QuantizeV2 input=1,2,3, minrange=1,2, maxrange...
GHSA-R4C4-5FPQ-56WG Heap OOB in boosted trees
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit: python import tensorflow as tf tf.rawops.BoostedTreesSparseCalculateBestFeatureSplit nodeidrange=0,10, statssummaryindices=1, 2,...
Heap OOB in boosted trees
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit: python import tensorflow as tf tf.rawops.BoostedTreesSparseCalculateBestFeatureSplit nodeidrange=0,10, statssummaryindices=1, 2,...
GHSA-V82P-HV3V-P6QP Incomplete validation in MKL requantization
Impact Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays: python import tensorflow as tf tf.rawops.RequantizationRangePerChannel...
Incomplete validation in MKL requantization
Impact Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays: python import tensorflow as tf tf.rawops.RequantizationRangePerChannel...
GHSA-W4XF-2PQW-5MQ7 Reference binding to nullptr in `RaggedTensorToVariant`
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant: python import tensorflow as tf tf.rawops.RaggedTensorToVariant rtnestedsplits=, rtdensevalues=1,2,3, batchedinput=True The implementation has an incomplete validation of the...
Reference binding to nullptr in `RaggedTensorToVariant`
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant: python import tensorflow as tf tf.rawops.RaggedTensorToVariant rtnestedsplits=, rtdensevalues=1,2,3, batchedinput=True The implementation has an incomplete validation of the...
GHSA-W74J-V8XH-3W5H Reference binding to nullptr in unicode encoding
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.UnicodeEncode: python import tensorflow as tf from tensorflow.python.ops import genstringops genstringops.unicodeencode inputvalues=, inputsplits=, outputencoding='UTF-8', errors='ignore',...
Reference binding to nullptr in unicode encoding
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.UnicodeEncode: python import tensorflow as tf from tensorflow.python.ops import genstringops genstringops.unicodeencode inputvalues=, inputsplits=, outputencoding='UTF-8', errors='ignore',...
FPE in `tf.raw_ops.UnravelIndex`
Impact An attacker can cause denial of service in applications serving models using tf.rawops.UnravelIndex by triggering a division by 0: python import tensorflow as tf tf.rawops.UnravelIndexindices=-1, dims=1,0,2 The implementation does not check that the tensor subsumed by dims is not empty...
GHSA-2WMV-37VQ-52G5 FPE in `tf.raw_ops.UnravelIndex`
Impact An attacker can cause denial of service in applications serving models using tf.rawops.UnravelIndex by triggering a division by 0: python import tensorflow as tf tf.rawops.UnravelIndexindices=-1, dims=1,0,2 The implementation does not check that the tensor subsumed by dims is not empty...
Crash in NMS ops caused by integer conversion to unsigned
Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0: python import tensorflow as tf tf.rawops.NonMaxSuppressionV5 boxes=0.1,0.1,0.1,0.1,0.2,0.2,0.2,0.2,0.3,0.3,0.3,0.3, scores=1.0,2.0,3.0, maxoutputsize=-1...
GHSA-VMJW-C2VP-P33C Crash in NMS ops caused by integer conversion to unsigned
Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0: python import tensorflow as tf tf.rawops.NonMaxSuppressionV5 boxes=0.1,0.1,0.1,0.1,0.2,0.2,0.2,0.2,0.3,0.3,0.3,0.3, scores=1.0,2.0,3.0, maxoutputsize=-1...
Heap OOB in `UpperBound` and `LowerBound`
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.UpperBound: python import tensorflow as tf tf.rawops.UpperBound sortedinput=1,2,3, values=tf.constantvalue=0,0,0,1,1,1,2,2,2,dtype=tf.int64, outtype=tf.int64 The...
GHSA-9697-98PF-4RW7 Heap OOB in `UpperBound` and `LowerBound`
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.UpperBound: python import tensorflow as tf tf.rawops.UpperBound sortedinput=1,2,3, values=tf.constantvalue=0,0,0,1,1,1,2,2,2,dtype=tf.int64, outtype=tf.int64 The...
Reference binding to nullptr in map operations
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations: python import tensorflow as tf tf.rawops.MapPeek key=tf.constant8,dtype=tf.int64, indices=, dtypes=tf.int32, capacity=8, memorylimit=128 The implementation...
GHSA-QR82-2C78-4M8H Reference binding to nullptr in map operations
Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations: python import tensorflow as tf tf.rawops.MapPeek key=tf.constant8,dtype=tf.int64, indices=, dtypes=tf.int32, capacity=8, memorylimit=128 The implementation...
Heap OOB in `SdcaOptimizerV2`
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2: python import tensorflow as tf tf.rawops.SdcaOptimizerV2 sparseexampleindices=1, sparsefeatureindices=1, sparsefeaturevalues=1.0,2.0,...
GHSA-5HJ3-VJJF-F5M7 Heap OOB in `SdcaOptimizerV2`
Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2: python import tensorflow as tf tf.rawops.SdcaOptimizerV2 sparseexampleindices=1, sparsefeatureindices=1, sparsefeaturevalues=1.0,2.0,...
GHSA-278G-RQ84-9HMG `CHECK`-fail in `MapStage`
Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage: python import tensorflow as tf tf.rawops.MapStage key=tf.constant, shape=0, 0, 0, 0, dtype=tf.int64, indices=tf.constant0, dtype=tf.int32, values=tf.constant0, dtype=tf.int32, dtypes=tf.int32, tf.int64,...