Google Tensorflow vulnerabilities

CVE-2021-41210 [HIGH] CWE-125 CVE-2021-41210: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as thes

CVE-2021-41225 [HIGH] CWE-908 CVE-2021-41225: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappl TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We

CVE-2021-41220 [HIGH] CWE-416 CVE-2021-41220: TensorFlow is an open source platform for machine learning. In affected versions the async implement TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0.

CVE-2021-41221 [HIGH] CWE-120 CVE-2021-41221: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have cert

CVE-2021-41203 [HIGH] CWE-345 CVE-2021-41203: TensorFlow is an open source platform for machine learning. In affected versions an attacker can tri TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fi

CVE-2021-41226 [HIGH] CWE-125 CVE-2021-41226: TensorFlow is an open source platform for machine learning. In affected versions the implementation TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this com

CVE-2021-41214 [HIGH] CWE-824 CVE-2021-41214: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are al

CVE-2021-41213 [MEDIUM] CWE-667 CVE-2021-41213: TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock` Python object. Loading any model which contains mutually recursive functions is vulnerable

CVE-2021-41202 [MEDIUM] CWE-681 CVE-2021-41202: TensorFlow is an open source platform for machine learning. In affected versions while calculating t TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be tr

CVE-2021-41199 [MEDIUM] CWE-190 CVE-2021-41199: TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` st

CVE-2021-41222 [MEDIUM] CWE-682 CVE-2021-41222: TensorFlow is an open source platform for machine learning. In affected versions the implementation TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick thi

CVE-2021-41195 [MEDIUM] CVE-2021-41195: TensorFlow is an open source platform for machine learning. In affected versions the implementation TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs

CVE-2021-41198 [MEDIUM] CWE-190 CVE-2021-41198: TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is cal TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement.

CVE-2021-41217 [MEDIUM] CWE-476 CVE-2021-41217: TensorFlow is an open source platform for machine learning. In affected versions the process of buil TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when e

CVE-2021-41200 [MEDIUM] CWE-617 CVE-2021-41200: TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.crea TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also af

CVE-2021-41215 [MEDIUM] CWE-476 CVE-2021-41215: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be includ

CVE-2021-41207 [MEDIUM] CWE-369 CVE-2021-41207: TensorFlow is an open source platform for machine learning. In affected versions the implementation TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected

CVE-2021-41227 [MEDIUM] CWE-125 CVE-2021-41227: TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype.

CVE-2021-41209 [MEDIUM] CWE-369 CVE-2021-41209: TensorFlow is an open source platform for machine learning. In affected versions the implementations TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are als

CVE-2021-41218 [MEDIUM] CWE-369 CVE-2021-41218: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow