Google Tensorflow vulnerabilities

CVE-2021-37638 [HIGH] CWE-476 CVE-2021-37638: TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kerne

CVE-2022-36014 [HIGH] CWE-476 CVE-2022-36014: TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receive TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commi

CVE-2022-36012 [HIGH] CWE-617 CVE-2022-36012: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionT TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, Te

CVE-2020-26269 [HIGH] CWE-125 CVE-2020-26269: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesyste In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PR

CVE-2022-41909 [HIGH] CWE-20 CVE-2022-41909: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid ` TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be

CVE-2022-41908 [HIGH] CWE-20 CVE-2022-41908: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 byt TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3,

CVE-2022-41895 [HIGH] CWE-125 CVE-2022-41895: TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize inpu TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and T

CVE-2022-41901 [HIGH] CWE-20 CVE-2022-41901: TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a m TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in `tf.raw_ops.SparseMatrixNNZ`. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in TensorFlow 2.11. We will also cherrypick this com

CVE-2022-41897 [HIGH] CWE-125 CVE-2022-41897: TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsiz TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`, TensorFlow will crash. We have patched the issue in GitHub commit d71090c3e5ca325bdf4b02eb236cfb3ee823e927. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on T

CVE-2022-41896 [HIGH] CWE-20 CVE-2022-41896: TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. We have patched the issue in GitHub commit 39ec7eaf1428e90c37787e5b3fbd68ebd3c48860. The fix will be included in TensorFlow 2.11. We will also cherrypick

CVE-2022-41898 [HIGH] CWE-20 CVE-2022-41898: TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given em TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as

CVE-2022-41890 [HIGH] CWE-704 CVE-2022-41890: TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input large TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in `tf.experimental.numpy.outer` by passing in large input to the input `b`. We have patched the issue in GitHub commit 8310bf8dd188ff780e7fc5324

CVE-2022-36004 [HIGH] CWE-617 CVE-2022-36004: TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large in TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this co

CVE-2022-41886 [HIGH] CWE-131 CVE-2022-41886: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransfor TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and Tens

CVE-2022-41891 [HIGH] CWE-20 CVE-2022-41891: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is give TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. The fix will be included in TensorFlow 2.11. We will also ch

CVE-2022-35934 [HIGH] CWE-617 CVE-2022-35934: TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in T TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555. The fix will be include

CVE-2022-35992 [HIGH] CWE-617 CVE-2022-35992: TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fix will be included in TensorFlow 2.10.0. We will a

CVE-2022-36002 [HIGH] CWE-617 CVE-2022-36002: TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar inpu TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on Tenso

CVE-2022-36003 [HIGH] CWE-617 CVE-2022-36003: TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large in TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this co

CVE-2022-41885 [HIGH] CWE-131 CVE-2022-41885: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorF