Heap OOB in TFLite

Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data: cc if axis size; ++i if i datai = inputdims.datai; else if i == axis outputdims-datai = 1; else outputdims-datai = inputdims.datai - 1; If axis is a large negative val...

GHSA-C545-C4F9-RF6V Heap OOB in TFLite

Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data: cc if axis size; ++i if i datai = inputdims.datai; else if i == axis outputdims-datai = 1; else outputdims-datai = inputdims.datai - 1; If axis is a large negative val...

GHSA-JWF9-W5XM-F437 Heap OOB in TFLite's `Gather*` implementations

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices. Similar issue exists in Gather implementation. python impor...

Heap OOB in TFLite's `Gather*` implementations

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices. Similar issue exists in Gather implementation. python impor...

GHSA-MHHC-Q96P-MFM9 Infinite loop in TFLite

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition: cc for int i = 0; i params-ellipsismask // ... int ellipsisendidx = std::mini + 1 + numaddaxis +...

Infinite loop in TFLite

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition: cc for int i = 0; i params-ellipsismask // ... int ellipsisendidx = std::mini + 1 + numaddaxis +...

GHSA-VCJJ-9VG7-VF68 Null pointer dereference in TFLite

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: python import tensorflow as tf model = tf.keras.models.Sequential model.addtf.keras.Inputshape=1, 2, 3 model.addtf.keras.layers.Dense0, activation='relu'...

Null pointer dereference in TFLite

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: python import tensorflow as tf model = tf.keras.models.Sequential model.addtf.keras.Inputshape=1, 2, 3 model.addtf.keras.layers.Dense0, activation='relu'...

GHSA-WF5P-C75W-W3WH Null pointer dereference in TFLite MLIR optimizations

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a...

Null pointer dereference in TFLite MLIR optimizations

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a...

Use after free and segfault in shape inference functions

Impact When running shape functions, some functions such as MutableHashTableShape produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to...

GHSA-27QF-JWM8-G7F3 FPE in LSH in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. cc int RunningSignBitconst TfLiteTensor input, const TfLiteTensor weight, float seed int inputitembytes = input-bytes / SizeOfDimensioninput, 0; // ... There is no check that the first...

FPE in LSH in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. cc int RunningSignBitconst TfLiteTensor input, const TfLiteTensor weight, float seed int inputitembytes = input-bytes / SizeOfDimensioninput, 0; // ... There is no check that the first...

GHSA-CMGW-8VPC-RC59 Segfault on strings tensors with mistmatched dimensions, due to Go code

Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method...

Segfault on strings tensors with mistmatched dimensions, due to Go code

Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TFTStringDealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64070)

Google TensorFlow is an end-to-end open source machine learning platform. the implementation of tf.rawops.SparseDenseCwiseDiv in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. No details of the vulnerability are currently available...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64068)

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.ResourceGather in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. An attacker could exploit this vulnerability to cause a denial of service...

Google TensorFlow integer overflow vulnerability (CNVD-2021-64075)

Google TensorFlow is an end-to-end open source machine learning platform. An integer overflow vulnerability exists in the implementation of tf.rawops.QuantizeAndDequantizeV4Grad in versions prior to Google TensorFlow 2.6.0. The vulnerability stems from converting a signed integer value to an...

Google TensorFlow null pointer dereference vulnerability (CNVD-2021-64073)

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.UncompressElement code in versions prior to Google TensorFlow 2.6.0 is vulnerable to null pointer dereference. No detailed vulnerability details are available at this time...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64067)

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.ResourceScatterDiv implementation in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. No detailed vulnerability details are available at this time...