CVE-2021-37651

TensorFlow: The FractionalAvgPoolGrad path has a heap-based buffer overflow when handling empty inputs, caused by not validating that the input tensor is non-empty. The implementation constructs an empty EigenDoubleMatrixMap and accesses out-of-bounds buffers. A patch was committed (0f931751fb20f...

CVE-2021-37651 Heap buffer overflow in `FractionalAvgPoolGrad` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for tf.rawops.FractionalAvgPoolGrad can be tricked into accessing data outside of bounds of heap allocated buffers. The implementation does not validate that the input tensor is non-empt...

CVE-2021-37650

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for tf.rawops.ExperimentalDatasetToTFRecord and tf.rawops.DatasetToTFRecord can trigger heap buffer overflow and segmentation fault. The implementation assumes that all records in the...

CVE-2021-37650 Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for tf.rawops.ExperimentalDatasetToTFRecord and tf.rawops.DatasetToTFRecord can trigger heap buffer overflow and segmentation fault. The implementation assumes that all records in the...

CVE-2021-37650

CVE-2021-37650 affects TensorFlow where the implementations tf.raw_ops.ExperimentalDatasetToTFRecord and tf.raw_ops.DatasetToTFRecord can trigger a heap-based buffer overflow and segmentation fault because records are assumed to be strings but may be numeric. The GNOTO advisory in the Connected d...

CVE-2021-37662

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in BoostedTreesCalculateBestGainsPerFeature and similar attack can occur in BoostedTreesCalculateBestFeatureSplitV2. The...

CVE-2021-37662 Reference binding to nullptr in boosted trees in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in BoostedTreesCalculateBestGainsPerFeature and similar attack can occur in BoostedTreesCalculateBestFeatureSplitV2. The...

CVE-2021-37662

CVE-2021-37662 stems from a TensorFlow vulnerability where a reference binding to nullptr in BoostedTreesCalculateBestGainsPerFeature and BoostedTreesCalculateBestFeatureSplitV2 may trigger undefined behavior due to input not being validated in stats_ops.cc. GitHub patches 9c87c32c7... and 429f00...

CVE-2021-37656 Reference binding to nullptr in `RaggedTensorToSparse` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToSparse. The implementation has an incomplete validation of the splits values: it does not check...

CVE-2021-37656

TensorFlow CVE-2021-37656 affects RaggedTensorToSparse, caused by incomplete validation of splits values which can bind a reference to a null pointer, leading to undefined behavior. The issue is addressed by a patch in the cited commit and will be included in TensorFlow 2.6.0, with backports to 2...

CVE-2021-37657 Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixDiagV. The implementation has incomplete validation that the value of k is a valid...

CVE-2021-37657

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixDiagV. The implementation has incomplete validation that the value of k is a valid...

CVE-2021-37657

TensorFlow CVE-2021-37657 affects MatrixDiagV* operations where the implementation fails to validate the number of elements in k (tensor), allowing undefined behavior from a null pointer dereference. The issue is fixed in commit f2a673bd34f0d64b8e40a551ac78989d16daad09 and will be included in Ten...

CVE-2021-37658

CVE-2021-37658 affects TensorFlow and is tied to a null-pointer binding issue in tf.raw_ops.MatrixSetDiagV* due to incomplete validation of the tensor k. The vulnerability allows undefined behavior when an empty tensor is passed for k, as code accesses the first element without proper checks. The...

CVE-2021-37658

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixSetDiagV. The implementation has incomplete validation that the value of k is a...

CVE-2021-37658 Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixSetDiagV. The implementation has incomplete validation that the value of k is a...

CVE-2021-37644 `std::abort` raised from `TensorListReserve` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to numelements list argument of tf.rawops.TensorListReserve causes the runtime to abort the process due to reallocating a std::vector to have a negative number of elements. The...

CVE-2021-37644

TensorFlow CVE-2021-37644 involves a local issue where providing a negative value in the num_elements argument to tf.raw_ops.TensorListReserve triggers a runtime abort when std::vector.resize is called with an invalid size. The vulnerability details are supported by a GitHub advisory describing t...

CVE-2021-37644

TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to numelements list argument of tf.rawops.TensorListReserve causes the runtime to abort the process due to reallocating a std::vector to have a negative number of elements. The...

CVE-2021-37654 Heap OOB and CHECK fail in `ResourceGather` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow using tf.rawops.ResourceGather or a read from outside the bounds of heap allocated data in the same API in a release build. Th...