Division by 0 in `FusedBatchNorm`

Impact An attacker can cause a denial of service via a FPE runtime error in tf.rawops.FusedBatchNorm: python import tensorflow as tf x = tf.constant, shape=1, 1, 1, 0, dtype=tf.float32 scale = tf.constant, shape=0, dtype=tf.float32 offset = tf.constant, shape=0, dtype=tf.float32 mean = tf.constan...

Division by 0 in `DenseCountSparseOutput`

Impact An attacker can cause a denial of service via a FPE runtime error in tf.rawops.DenseCountSparseOutput: python import tensorflow as tf values = tf.constant, shape=0, 0, dtype=tf.int64 weights = tf.constant tf.rawops.DenseCountSparseOutput values=values, weights=weights, minlength=-1,...

CHECK-failure in `UnsortedSegmentJoin`

Impact An attacker can cause a denial of service by controlling the values of numsegments tensor argument for UnsortedSegmentJoin: python import tensorflow as tf inputs = tf.constant, dtype=tf.string segmentids = tf.constant, dtype=tf.int32 numsegments = tf.constant, dtype=tf.int32 separator = ''...

OOB read in `MatrixTriangularSolve`

Impact The implementation of MatrixTriangularSolve fails to terminate kernel execution if one validation condition fails: cc void ValidateInputTensorsOpKernelContext ctx, const Tensor& in0, const Tensor& in1 override OPREQUIRES ctx, in0.dims = 2, errors::InvalidArgument"In0 ndims must be = 2: ",...

Division by 0 in `FractionalAvgPool`

Impact An attacker can cause a runtime division by zero error and denial of service in tf.rawops.FractionalAvgPool: python import tensorflow as tf value = tf.constant60, shape=1, 1, 1, 1, dtype=tf.int32 poolingratio = 1.0, 1.0000014345305555, 1.0, 1.0 pseudorandom = False overlapping = False...

Division by 0 in `QuantizedAdd`

Impact An attacker can cause a runtime division by zero error and denial of service in tf.rawops.QuantizedAdd: python import tensorflow as tf x = tf.constant68, 228, shape=2, 1, dtype=tf.quint8 y = tf.constant, shape=2, 0, dtype=tf.quint8 minx = tf.constant10.723421015884028 maxx =...

Division by 0 in `QuantizedBatchNormWithGlobalNormalization`

Impact An attacker can cause a runtime division by zero error and denial of service in tf.rawops.QuantizedBatchNormWithGlobalNormalization: python import tensorflow as tf t = tf.constant, shape=0, 0, 0, 0, dtype=tf.quint8 tmin = tf.constant-10.0, dtype=tf.float32 tmax = tf.constant-10.0,...

Division by 0 in `QuantizedBiasAdd`

Impact An attacker can trigger an integer division by zero undefined behavior in tf.rawops.QuantizedBiasAdd: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 0, 0, dtype=tf.quint8 bias = tf.constant, shape=0, dtype=tf.quint8 mininput = tf.constant-10.0, dtype=tf.float32...

CHECK-fail in `QuantizeAndDequantizeV4Grad`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.QuantizeAndDequantizeV4Grad: python import tensorflow as tf gradienttensor = tf.constant0.0, shape=1 inputtensor = tf.constant0.0, shape=1 inputmin = tf.constant0.0, shape=1, 1 inputmax = tf.constant0.0, shape=1, 1...

GHSA-FPHQ-GW9M-GHRV CHECK-fail in `CTCGreedyDecoder`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.CTCGreedyDecoder: python import tensorflow as tf inputs = tf.constant, shape=18, 2, 0, dtype=tf.float32 sequencelength = tf.constant-100, 17, shape=2, dtype=tf.int32 mergerepeated = False...

CHECK-fail in `CTCGreedyDecoder`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.CTCGreedyDecoder: python import tensorflow as tf inputs = tf.constant, shape=18, 2, 0, dtype=tf.float32 sequencelength = tf.constant-100, 17, shape=2, dtype=tf.int32 mergerepeated = False...

Null pointer dereference in `StringNGrams`

Impact An attacker can trigger a dereference of a null pointer in tf.rawops.StringNGrams: python import tensorflow as tf data=tf.constant'' 11, shape=11, dtype=tf.string splits = 0115 splits.append3 datasplits=tf.constantsplits, shape=116, dtype=tf.int64 tf.rawops.StringNGramsdata=data,...

Division by zero in `Conv2DBackpropFilter`

Impact An attacker can cause a division by zero to occur in Conv2DBackpropFilter: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 0, 0, dtype=tf.float32 filtersizes = tf.constant0, 0, 0, 0, shape=4, dtype=tf.int32 outbackprop = tf.constant, shape=0, 0, 0, 0, dtype=tf.float32...

Heap buffer overflow in `QuantizedResizeBilinear`

Impact An attacker can cause a heap buffer overflow in QuantizedResizeBilinear by passing in invalid thresholds for the quantization: python import tensorflow as tf images = tf.constant, shape=0, dtype=tf.qint32 size = tf.constant, shape=0, dtype=tf.int32 min = tf.constant, dtype=tf.float32 max =...

Heap buffer overflow in `QuantizedReshape`

Impact An attacker can cause a heap buffer overflow in QuantizedReshape by passing in invalid thresholds for the quantization: python import tensorflow as tf tensor = tf.constant, dtype=tf.qint32 shape = tf.constant, dtype=tf.int32 inputmin = tf.constant, dtype=tf.float32 inputmax = tf.constant,...

GHSA-M3F9-W3P3-P669 Heap buffer overflow in `QuantizedMul`

Impact An attacker can cause a heap buffer overflow in QuantizedMul by passing in invalid thresholds for the quantization: python import tensorflow as tf x = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 y = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 minx = tf.constant, dtype=tf.float32...

Heap buffer overflow in `QuantizedMul`

Impact An attacker can cause a heap buffer overflow in QuantizedMul by passing in invalid thresholds for the quantization: python import tensorflow as tf x = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 y = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 minx = tf.constant, dtype=tf.float32...

CHECK-fail in SparseConcat

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.SparseConcat: python import tensorflow as tf import numpy as np indices1 = tf.constant514, 514, 514, 514, dtype=tf.int64 indices2 = tf.constant514, 530, 599, 877, dtype=tf.int64 indices = indices1, indices2 values1 =...

CHECK-fail in DrawBoundingBoxes

Impact An attacker can trigger a denial of service via a CHECK failure by passing an empty image to tf.rawops.DrawBoundingBoxes: python import tensorflow as tf images = tf.fill53, 0, 48, 1, 0. boxes = tf.fill53, 31, 4, 0. boxes = tf.Variableboxes boxes0, 0, 0.assign3.90621...

Heap out of bounds read in `RaggedCross`

Impact An attacker can force accesses outside the bounds of heap allocated arrays by passing in invalid tensor values to tf.rawops.RaggedCross: python import tensorflow as tf raggedvalues = raggedrowsplits = sparseindices = sparsevalues = sparseshape = denseinputselem = tf.constant, shape=92, 0,...