Google Tensorflow vulnerabilities

CVE-2023-25669 [HIGH] CWE-697 CVE-2023-25669: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for `tf.raw_ops.AvgPoolGrad`, it can give a floating point exception. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2023-25666 [HIGH] CWE-697 CVE-2023-25666: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, the TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2022-23592 [HIGH] CWE-125 CVE-2022-23592: Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a hea Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included

CVE-2020-15214 [HIGH] CWE-787 CVE-2020-15214: In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor. This results in allocating ins

CVE-2021-41201 [HIGH] CWE-824 CVE-2021-41201: TensorFlow is an open source platform for machine learning. In affeced versions during execution, `E TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to `tru

CVE-2021-29571 [HIGH] CWE-787 CVE-2021-29571: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/31bd5026304677faa8a0b77602c6154171b9aec1/tensorflow/core

CVE-2021-41221 [HIGH] CWE-120 CVE-2021-41221: TensorFlow is an open source platform for machine learning. In affected versions the shape inference TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have cert

CVE-2021-29514 [HIGH] CWE-787 CVE-2021-29514: TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of ` TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the `splits` tensor buffer

CVE-2021-41219 [HIGH] CWE-824 CVE-2021-41219: TensorFlow is an open source platform for machine learning. In affected versions the code for sparse TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve t

CVE-2021-41208 [HIGH] CWE-476 CVE-2021-41208: TensorFlow is an open source platform for machine learning. In affected versions the code for booste TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also r

CVE-2023-25801 [HIGH] CWE-415 CVE-2023-25801: TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0

CVE-2023-25671 [HIGH] CWE-787 CVE-2023-25671: TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mis TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2023-25670 [HIGH] CWE-476 CVE-2023-25670: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2023-25660 [HIGH] CWE-476 CVE-2023-25660: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, whe TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

CVE-2023-25675 [HIGH] CWE-697 CVE-2023-25675: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2. TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.Bincount` segfaults when given a parameter `weights` that is neither the same shape as parameter `arr` nor a length-0 tensor. A fix is included in TensorFlow 2.12.0 and 2.11.1.

CVE-2021-29529 [HIGH] CWE-131 CVE-2021-29529: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a hea TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/44b7f

CVE-2021-29609 [HIGH] CWE-665 CVE-2021-29609: TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `Spa TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f8491

CVE-2021-29607 [HIGH] CWE-754 CVE-2021-29607: TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `Spa TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f8491

CVE-2021-29520 [HIGH] CWE-120 CVE-2021-29520: TensorFlow is an end-to-end open source platform for machine learning. Missing validation between ar TensorFlow is an end-to-end open source platform for machine learning. Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/4814fafb0ca6b5ab58a09411523b2193fed23fed/tensorflow/core/kernels/conv_grad_shape_uti

CVE-2020-15203 [HIGH] CWE-20 CVE-2020-15203: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argum In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d8