PT-2021-21772 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: TensorFlow is an end-to-end open source platform for machine learning. In affect...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48856)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from a lack of validation in tf.rawops.RaggedTensorToTensor, and can be exploited by an...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48857)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which stems from the absence of loops between nodes of a TFlite graph. No detailed vulnerability details are...

Google TensorFlow Arbitrary File Overwrite Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an arbitrary file overwrite vulnerability, which originates from an issue caused when tf.keras.utils.getfile is used with extract=True, and can be exploited by an...

Google TensorFlow code issue vulnerability (CNVD-2021-46657)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3,2.1.4, which can be exploited by an attacker to cause a denial of service by exploiting a CHECK failure from the implementation...

CVE-2021-35958

TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.getfile is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives...

GHSA-6F89-8J54-29XF Heap buffer overflow in `FractionalAvgPoolGrad`

Impact The implementation of tf.rawops.FractionalAvgPoolGrad is vulnerable to a heap buffer overflow: python import tensorflow as tf originputtensorshape = tf.constant1, 3, 2, 3, shape=4, dtype=tf.int64 outbackprop = tf.constant2, shape=1, 1, 1, 1, dtype=tf.int64 rowpoolingsequence = tf.constant1...

GHSA-PVRC-HG3F-58R6 Heap OOB access in `Dilation2DBackpropInput`

Impact An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.rawops.Dilation2DBackpropInput: python import tensorflow as tf inputtensor = tf.constant1.1 81, shape=3, 3, 3, 3, dtype=tf.float32 filter = tf.constant, shape=0, 0, 3, dtype=tf.float32...

GHSA-X4G7-FVJJ-PRG8 Division by 0 in `QuantizedConv2D`

Impact An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D: python import tensorflow as tf input = tf.zeros1, 1, 1, 1, dtype=tf.quint8 filter = tf.constant, shape=1, 0, 1, 1, dtype=tf.quint8 mininput = tf.constant0.0 maxinput = tf.constant0.0001 minfilter = tf.constant0.0 maxfilt...

GHSA-452G-F7FP-9JF7 Type confusion during tensor casts lead to dereferencing null pointers

Impact Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. There are multiple ways to reproduce this, listing a few examples here: python import tensorflow as tf import numpy as np data =...

Google TensorFlow divide-by-zero error vulnerability (CNVD-2021-36562)

Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv3DBackprop implementation in TensorFlow versions prior to 2.5.0. No detailed vulnerability details are provided at this time...

Google TensorFlow heap buffer overflow vulnerability (CNVD-2021-37648)

Google TensorFlow is an end-to-end open source machine learning platform. A heap buffer overflow vulnerability exists in tf.rawops.FractionalAvgPoolGrad in Google TensorFlow. No detailed vulnerability details are provided at this time...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-36563)

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in the tf.rawops.AddManySparseToTensorsMap implementation in TensorFlow versions prior to 2.5.0. An attacker could exploit this vulnerability to cause a CHECK-failure denial of servi...

TensorFlow divide-by-zero error vulnerability (CNVD-2021-36564)

Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv2DBackpropFilter implementation in TensorFlow versions prior to 2.5.0. No detailed vulnerability details are provided at this time...

TensorFlow heap buffer overflow vulnerability (CNVD-2021-36543)

Google TensorFlow is an end-to-end open source machine learning platform. A heap buffer overflow vulnerability exists in the QuantizedMul implementation in TensorFlow versions prior to 2.5.0. An attacker can exploit this vulnerability by passing an invalid quantization threshold that results in a...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-37629)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow. The vulnerability stems from an FPE runtime error in tf.rawops.FusedBatchNorm. An attacker can exploit the vulnerability to cause a denial of service...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-37632)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.SparseSplit in Google TensorFlow. A locally authenticated attacker can exploit this vulnerability to cause a denial of service condition...

Google TensorFlow SparseDenseCwiseMul Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in Google TensorFlow SparseDenseCwiseMul. The vulnerability stems from a lack of authentication in tf.rawops.SparseDenseCwiseMul. An attacker can exploit the vulnerability to cause...

TensorFlow Denial of Service Vulnerability (CNVD-2021-36542)

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in TensorFlow. An attacker can exploit this vulnerability by passing empty images to tf.rawops.DrawBoundingBoxes to cause a CHECK failure denial of service...

Google TensorFlow heap buffer overflow vulnerability (CNVD-2021-37647)

Google TensorFlow is an end-to-end open source machine learning platform. A heap buffer overflow vulnerability exists in tf.rawops.AvgPool3DGrad in Google TensorFlow. No detailed vulnerability details are provided at this time...