CVE-2021-29526

Summary: CVE-2021-29526 affects TensorFlow’s Conv2D path, where the division by a caller-controlled quantity in tf.raw_ops.Conv2D can trigger a division by zero. This vulnerability is supported by multiple sources in connected documents (OSV entries and NVD/CVE references) that describe the under...

CVE-2021-29526 Division by 0 in `Conv2D`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.Conv2D. This is because the implementationhttps://github.com/tensorflow/tensorflow/blob/988087bd83f144af14087fe4fecee2d250d93737/tensorflow/core/kernels/convops.ccL261-L263...

CVE-2021-29527 Division by 0 in `QuantizedConv2D`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D. This is because the...

CVE-2021-29527

CVE-2021-29527 is a TensorFlow division-by-zero vulnerability in tf.raw_ops.QuantizedConv2D caused by a caller-controlled quantity in quantized_conv_ops.cc (lines 257–259). The fix is expected in TensorFlow 2.5.0, with cherry-picks to 2.4.2, 2.3.3, 2.2.3 and 2.1.4; multiple related advisories (GH...

CVE-2021-29528 Division by 0 in `QuantizedMul`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.QuantizedMul. This is because the...

CVE-2021-29528

CVE-2021-29528 is a TensorFlow vulnerability in the QuantizedMul path that can trigger a division by zero. The issue arises because the implementation divides by a quantity controlled by the caller, per the cited code path in quantized_mul_op.cc. Public details confirm affected TensorFlow release...

CVE-2021-29529

CVE-2021-29529 affects TensorFlow’s QuantizedResizeBilinear in tf.raw_ops.QuantizedResizeBilinear, where rounding of floating input can cause interpolation bounds to produce an out-of-bounds access, leading to a heap buffer overflow. The vulnerability arises because lower/upper interpolation boun...

CVE-2021-29529 Heap buffer overflow caused by rounding

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...

CVE-2021-29530 Invalid validation in `SparseMatrixSparseCholesky`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference by providing an invalid permutation to tf.rawops.SparseMatrixSparseCholesky. This is because the...

CVE-2021-29530

CVE-2021-29530 concerns TensorFlow’s SparseMatrixSparseCholesky: passing an invalid permutation could trigger a null pointer dereference due to incomplete input validation in the underlying code, allowing continuation after a failed check. Public sources (NVD, OSV, GHSA) describe the issue in Ten...

CVE-2021-29531

CVE-2021-29531 affects TensorFlow and relates to a denial-of-service risk in PNG encoding when an attacker supplies an empty input tensor for pixel data. The issue stems from encode_png_op.cc validating only total pixel count and passing image data to png::WriteImageToBuffer, which calls CHECK_NO...

CVE-2021-29532

Summary: CVE-2021-29532 affects TensorFlow and describes a heap out-of-bounds read in RaggedCross when processing tensors, due to missing validation of user-supplied indices in ragged/dense/sparse paths. The vulnerability arises from code that uses list indices (e.g., next_ragged/next_sparse/next...

CVE-2021-29532 Heap out of bounds read in `RaggedCross`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can force accesses outside the bounds of heap allocated arrays by passing in invalid tensor values to tf.rawops.RaggedCross. This is because the...

CVE-2021-29533

TensorFlow DrawBoundingBoxes (CVE-2021-29533) is affected by a CHECK_-driven input validation flaw that can crash the program when an empty image is passed. The root cause is input validation using CHECK_ instead of OP_REQUIRES, causing a negative max_box_row_clamp and a crash. The fix is include...

CVE-2021-29534

TensorFlow vulnerability CVE-2021-29534 concerns a CHECK-fail in tf.raw_ops.SparseConcat caused by using shapes[0] to define the output shape, leading to a denial of service via overflow in TensorShape initialization. Affected behavior occurs when shape dimensions are overflowed during InitDims/A...

CVE-2021-29535

CVE-2021-29535 affects TensorFlow’s QuantizedMul implementation. The vulnerability arises when four quantization thresholds are passed as inputs and may be empty tensors, causing a heap buffer overflow by accessing .flat()(0) on an empty buffer. This is rooted in the code path in quantized_mul_op...

CVE-2021-29535 Heap buffer overflow in `QuantizedMul`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedMul by passing in invalid thresholds for the quantization. This is because the...

CVE-2021-29536

TensorFlow’s CVE-2021-29536 is a heap buffer overflow in QuantizedReshape triggered when the input_min/input_max tensors are empty. The issue arises because code assumes scalar inputs and accesses .flat()(0), which overflows if the tensors contain no elements. The fix is included in TensorFlow 2....

CVE-2021-29537

CVE-2021-29537 affects TensorFlow: a heap buffer overflow in QuantizedResizeBilinear triggered by invalid quantization thresholds. Root cause is assuming two scalar inputs are valid and directly indexing their values; if min/max tensors are empty, accessing element 0 overflows. Public details con...

CVE-2021-29537 Heap buffer overflow in `QuantizedResizeBilinear`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedResizeBilinear by passing in invalid thresholds for the quantization. This is because the...