CVE-2021-29577

CVE-2021-29577 describes a heap-buffer-overflow in TensorFlow’s tf.raw_ops.AvgPool3DGrad caused by an assumption that orig_input_shape and grad have similar first/last dimensions without proper validation. Public sources (NVD, OSV, GHSA) confirm the issue and its impact as a memory corruption vul...

CVE-2021-29577 Heap buffer overflow in `AvgPool3DGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.AvgPool3DGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29577

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.AvgPool3DGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29578

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalAvgPoolGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29578 Heap buffer overflow in `FractionalAvgPoolGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalAvgPoolGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29578

CVE-2021-29578 : TensorFlow’s tf.raw_ops.FractionalAvgPoolGrad is vulnerable to a heap-based buffer overflow caused by a missing validation of pooling sequence arguments against the out_backprop tensor shape. Multiple connected sources corroborate the issue and provide the same root cause. The mi...

CVE-2021-29579

TensorFlow CVE-2021-29579 concerns a heap-based buffer overflow in tf.raw_ops.MaxPoolGrad caused by missing validation when indexing out_backprop_flat. The cited patch (commit a74768f8e4efbda4def9f16ee7e13cf3922ac5f7) fixes boundary checks and was planned to be included in TensorFlow 2.6.0, with ...

CVE-2021-29579

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29579 Heap buffer overflow in `MaxPoolGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29580 Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalMaxPoolGrad triggers an undefined behavior if one of the input tensors is empty. The code is also vulnerable to a denial of service attack as a CHECK condition becomes false and aborts...

CVE-2021-29580

The CVE covers TensorFlow tf.raw_ops.FractionalMaxPoolGrad with undefined behavior when an input tensor is empty and a_CHECK failure that can abort the process, per multiple sources in the Initial document. The issue arises from input/output validation (empty tensors and rank checks) in fractiona...

CVE-2021-29580

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalMaxPoolGrad triggers an undefined behavior if one of the input tensors is empty. The code is also vulnerable to a denial of service attack as a CHECK condition becomes false and aborts...

CVE-2021-29581

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.CTCBeamSearchDecoder, an attacker can trigger denial of service via segmentation faults. The...

CVE-2021-29581 Segfault in `CTCBeamSearchDecoder`

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.CTCBeamSearchDecoder, an attacker can trigger denial of service via segmentation faults. The...

CVE-2021-29581

CVE-2021-29581 describes a denial-of-service vulnerability in TensorFlow’s tf.raw_ops.CTCBeamSearchDecoder, where lack of input validation on empty tensors allows a local attacker to trigger a segfault by reading from a null buffer. The issue affects TensorFlow versions in scope (2.x) and is addr...

CVE-2021-29582 Heap OOB read in `tf.raw_ops.Dequantize`

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.Dequantize, an attacker can trigger a read from outside of bounds of heap allocated data. The...

CVE-2021-29582

TensorFlow CVE-2021-29582 describes a heap-out-of-bounds read in tf.raw_ops.Dequantize caused by a shape mismatch between min_range and max_range tensors. The vulnerability allows a local attacker to trigger reads outside heap data. The remediation is a patch, with fixes targeted for TensorFlow 2...

CVE-2021-29583

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FusedBatchNorm is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The...

CVE-2021-29583 Heap buffer overflow and undefined behavior in `FusedBatchNorm`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FusedBatchNorm is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The...

CVE-2021-29583

TensorFlow CVE-2021-29583 / GHSA-9XH4-23Q4-V6WR describe a heap buffer overflow and undefined behavior in tf.raw_ops.FusedBatchNorm when inputs like scale, offset, mean, or variance have mismatched shapes or are empty. Root cause: missing validation that these tensors match the number of channels...