GHSA-HQ7G-WWWP-Q46H `CHECK` fail via inputs in `SparseFillEmptyRowsGrad`

Impact If SparseFillEmptyRowsGrad is given empty inputs, TensorFlow will crash. python import tensorflow as tf tf.rawops.SparseFillEmptyRowsGrad reverseindexmap=, gradvalues=, name=None Patches We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will be...

GHSA-GQ2J-CR96-GVQX `MirrorPadGrad` heap out of bounds read

Impact If MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error. python import tensorflow as tf tf.rawops.MirrorPadGradinput=1, paddings=0x77f00000,0xa000000, mode = 'REFLECT' Patches We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec9...

GHSA-H7FF-CFC9-WMMH TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient`

Impact When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg0=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None...

CVE-2022-36005

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

CVE-2022-35990

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

PT-2022-23088

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when tf.quantization.fake quant with min max vars per channel...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. A security vulnerability exists in Google TensorFlow, which stems from the fact that when tf.quantization.fakequantwithminmaxvarsgradient receives non-scalar inputs min or...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. Google TensorFlow suffers from a security vulnerability that stems from the fact that when tf.quantization.fakequantwithminmaxvarsperchannelgradient receives an input min o...

PT-2022-23083

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue arises when the LRNGrad function is given an output image input tensor...

MAL-2022-3439 Malicious code in gradient-stringnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbc90d7f1ec5dc1c1558900467a2043b34a1473f060fa9855e8963f898c382d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbc90d7f1ec5dc1c1558900467a2043b34a1473f060fa9855e8963f898c382d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113c8aa7e58460260ad95b3d81fb9e9e4630315cd65aca4be2e12ba86400a49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57723e32d648c25724e92b0bae70a4858b05de601bcd3c204359d4c4ca01286f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3438 Malicious code in gradient-stringn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113c8aa7e58460260ad95b3d81fb9e9e4630315cd65aca4be2e12ba86400a49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3440 Malicious code in gradient-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b41f21443655193e21b66bf003d6b42f6bad9f00cc324004094871ca932651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Manipulating Machine-Learning Systems through the Order of the Training Data

Yet another adversarial ML attack: Most deep neural networks are trained by stochastic gradient descent. Now “stochastic” is a fancy Greek word for “random”; it means that the training data are fed into the model in random order. So what happens if the bad guys can cause the order to be not rando...

GHSA-VJG4-V33C-GGC4 Out of bounds read in Tensorflow

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap: python import tensorflow as tf @tf.function def test: y = tf.rawops.FractionalAvgPoolGrad originputtensorshape=2,2,2,2,...

PYSEC-2022-54

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this...

PT-2022-15064 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description: The estimator for the cost of some convolution operations in TensorFlow can be...

GHSA-7GHQ-FVR3-PJ2X Incomplete validation in `MaxPoolGrad`

Impact An attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation: python import tensorflow as tf tf.rawops.MaxPoolGrad originput = tf.constant, shape=3, 0, 0, 2, dtype=tf.float32, origoutput = tf.constant, shape=3, 0, 0, 2,...