tensorflow is vulnerable to denial of service (DoS) attacks. An attacker is able to cause denial of service conditions by providing a sparse_matrix
input that is not a matrix with a shape of rank 0, triggering a CHECK
fail in tf.raw_ops.SparseMatrixNNZ
.
github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h
github.com/tensorflow/tensorflow/commit/391ec802c94d084e7f32b7c66e712c7a68e29556
github.com/tensorflow/tensorflow/commit/4aa418ceb50056ea18432a9fa46d43e4ea37035e
github.com/tensorflow/tensorflow/commit/b3f2e67d759d46d0389972fdb4bae84751ee09e6
github.com/tensorflow/tensorflow/commit/f856d02e5322821aad155dad9b3acab1e9f5d693
github.com/tensorflow/tensorflow/pull/58566
github.com/tensorflow/tensorflow/pull/58567
github.com/tensorflow/tensorflow/pull/58573
github.com/tensorflow/tensorflow/security/advisories/GHSA-g9fm-r5mm-rf9f