Google Tensorflow vulnerabilities

CVE-2022-35970 [HIGH] CWE-20 CVE-2022-35970: TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_m TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0.

CVE-2022-35974 [HIGH] CWE-20 CVE-2022-35974: TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 73ad1815ebcfeb7c051f9c2f7ab5024380ca8613. The fix will be included in TensorFlow

CVE-2022-35986 [HIGH] CWE-20 CVE-2022-35986: TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty in TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f4fa903593bc39b2f79530a74b8. The fix will be included in TensorFlow 2.10.0. We will also cherryp

CVE-2022-35979 [HIGH] CWE-20 CVE-2022-35979: TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` a TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_features`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89. The fix will be included

CVE-2022-36017 [HIGH] CWE-20 CVE-2022-36017: TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `i TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The

CVE-2022-41885 [HIGH] CWE-131 CVE-2022-41885: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorF

CVE-2022-41886 [HIGH] CWE-131 CVE-2022-41886: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransfor TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and Tens

CVE-2022-41891 [HIGH] CWE-20 CVE-2022-41891: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is give TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. The fix will be included in TensorFlow 2.11. We will also ch

CVE-2022-35967 [HIGH] CWE-20 CVE-2022-35967: TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` o TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89. The fix will be included in TensorFlow 2.10.0.

CVE-2022-35972 [HIGH] CWE-20 CVE-2022-35972: TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_inpu TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be inclu

CVE-2022-35966 [HIGH] CWE-20 CVE-2022-35966: TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_inpu TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7cdf9d4d2083b739ec81cfdace546b0c99f50622. The fix will be included in TensorFlow 2.10

CVE-2022-35964 [HIGH] CWE-20 CVE-2022-35964: TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 2a458fc4866505be27c62f81474ecb2b870498fa. The fix will be included in TensorFlow 2.10.0. We

CVE-2022-36004 [HIGH] CWE-617 CVE-2022-36004: TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large in TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this co

CVE-2022-35934 [HIGH] CWE-617 CVE-2022-35934: TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in T TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555. The fix will be include

CVE-2022-36005 [HIGH] CWE-617 CVE-2022-36005: TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_mi TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is nonscalar, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit f3cf67ac5705f4f04721d15e485e192bb319feed. The fix will be included in T

CVE-2022-36001 [HIGH] CWE-617 CVE-2022-36001: TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an inp TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. The fix will be included in TensorFlow 2.10.0. We will als

CVE-2022-35992 [HIGH] CWE-617 CVE-2022-35992: TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fix will be included in TensorFlow 2.10.0. We will a

CVE-2022-35996 [HIGH] CWE-369 CVE-2022-35996: TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and t TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 611d80db29dd7b0cfb755772c69d60a

CVE-2022-36002 [HIGH] CWE-617 CVE-2022-36002: TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar inpu TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on Tenso

CVE-2022-36003 [HIGH] CWE-617 CVE-2022-36003: TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large in TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this co