CVE-2021-29614

CVE-2021-29614 affects TensorFlow: the tf.io.decode_raw path (padded version) mishandles fixed_length with wider datatypes, advancing the output pointer by fixed_length bytes even when only fixed_length bytes are copied. This causes parts of input not to be decoded and can lead to out-of-bounds w...

CVE-2021-29555

TensorFlow CVE-2021-29555 describes a denial-of-service vulnerability in tf.raw_ops.FusedBatchNorm caused by a division operation based on the last tensor dimension, which can be triggered by user-provided input. The issue affects the FusedBatchNorm path and has been patched; TensorFlow 2.5.0 wil...

CVE-2021-29556

CVE-2021-29556 affects TensorFlow cores with a Denial of Service via a division-by-first-dimension in tf.raw_ops.Reverse. The vulnerability arises because N = input.dim_size(0) is used to compute cost_per_unit, enabling a user-controlled trigger (through the tensor’s first dimension) to cause a F...

CVE-2021-29558 Heap buffer overflow in `SparseSplit`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.SparseSplit. This is because the...

CVE-2021-29558

TensorFlow SparseSplit heap overflow (CVE-2021-29558) : Multiple security records (OSV, GHSA, CNVD, NVD) describe a heap-based overflow in tf.raw_ops.SparseSplit caused by accessing an array element using a user-controlled offset in SparseTensor.h. The vulnerability can lead to denial of service ...

CVE-2021-29559

The CVE-2021-29559 case concerns TensorFlow’s UnicodeEncode in tf.raw_ops, where heap-out-of-bounds access can occur if input_value/input_splits do not form a valid sparse tensor. Root cause: implementation assumes a valid sparse tensor, enabling data access outside heap bounds. The issue is fixe...

CVE-2021-29560

TensorFlow RaggedTensorToTensor heap-based overflow vulnerability (CVE-2021-29560) arises when the code uses the same index to access two arrays in parallel during ragged tensor to tensor conversion. An attacker-controlled input can trigger a heap OOB access when parent_output_index is shorter th...

CVE-2021-29560 Heap buffer overflow in `RaggedTensorToTensor`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.RaggedTensorToTensor. This is because the...

CVE-2021-29561

CVE-2021-29561 (TensorFlow) describes a denial-of-service via a CHECK-fail in LoadAndRemapMatrix caused by assuming ckpt_path is a valid scalar; attackers can send a non-scalar tensor as the first argument. Connected docs confirm the same issue and note fixes will be applied in TensorFlow 2.5.0 w...

CVE-2021-29562

TensorFlow TF IRFFT CHECK-fail vulnerability (CVE-2021-29562) can cause denial of service via a CHECK failure in tf.raw_ops.IRFFT. Public details in OSV/GHSA entries confirm impact and patch strategy: fix in TensorFlow 2.5.0, with cherry-picks to 2.4.2, 2.3.3, 2.2.3 and 2.1.4. IBM CVE coverage an...

CVE-2021-29563

CVE-2021-29563 affects TensorFlow via a CHECK-fail in tf.raw_ops.RFFT that can trigger a denial of service when Eigen code operates on an empty matrix. The issue arises from a CHECK/ASSERT path and causes program termination rather than a traditional memory corruption exploit. The affected behavi...

CVE-2021-29564 Null pointer dereference in `EditDistance`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.EditDistance. This is because the...

CVE-2021-29565

TensorFlow CVE-2021-29565 describes a null pointer dereference in tf.raw_ops.SparseFillEmptyRows due to missing validation when dense_shape is empty. Connected sources confirm the issue, including a GitHub commit (faa76f39014ed3b5e2c158593b1335522e573c7f) and notes that the fix will be included i...

CVE-2021-29565 Null pointer dereference in `SparseFillEmptyRows`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.SparseFillEmptyRows. This is because of missing...

CVE-2021-29566

TensorFlow: CVE-2021-29566 is a heap-out-of-bounds (OOB) access in tf.raw_ops.Dilation2DBackpropInput due to missing input validation. This can cause writes outside the heap during backprop, as per the OSV/GHSA entries. The issue is fixed in TensorFlow 2.5.0 with cherry-picks to 2.4.2, 2.3.3, 2.2...

CVE-2021-29567

TensorFlow vulnerability CVE-2021-29567: SparseDenseCwiseMul lacks validation between input dimensions, only validating input ranks. This enables local attackers to trigger CHECK failures or heap-out-of-bounds writes, causing denial of service. Affected TF versions include 2.5.0 and older release...

CVE-2021-29568

TensorFlow vulnerability CVE-2021-29568 arises from binding to a NULL pointer in tf.raw_ops.ParameterizedTruncatedNormal due to not validating the shape argument before accessing shape_tensor.flat(0). The issue can cause undefined behavior; the affected commits patch the input validation. A fix w...

CVE-2021-29569

CVE-2021-29569: TensorFlow MaxPoolGradWithArgmax reads past heap bounds when input_min/input_max are empty. The issue stems from accessing first elements of flat() on empty tensors. Patches fix in TensorFlow 2.5.0 and will be cherry-picked to 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Affected ranges are th...

CVE-2021-29570

CVE-2021-29570 affects TensorFlow and specifically the tf.raw_ops.MaxPoolGradWithArgmax path. The vulnerability is a heap out-of-bounds read caused by using the same value to index two different arrays without guaranteed equal sizes, leading to reads beyond heap data when provided crafted inputs....

CVE-2021-29571 Memory corruption in `DrawBoundingBoxesV2`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...