Google Tensorflow vulnerabilities

CVE-2022-23591 [HIGH] CWE-400 CVE-2022-23591: Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does no Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution

CVE-2022-36027 [HIGH] CWE-20 CVE-2022-36027: TensorFlow is an open source platform for machine learning. When converting transposed convolutions TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this

CVE-2022-35941 [HIGH] CWE-617 CVE-2022-35941: TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argume TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is not checked. A negative `ksize` can trigger a `CHECK` failure and crash the program. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in TensorFlow 2.10

CVE-2022-35952 [HIGH] CWE-617 CVE-2022-35952: TensorFlow is an open source platform for machine learning. The `UnbatchGradOp` function takes an ar TensorFlow is an open source platform for machine learning. The `UnbatchGradOp` function takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program. It also requires its argument `batch_index` to contain three times the number of elements as indicated in its `batch_index.dim_size(0)`. An

CVE-2022-36013 [HIGH] CWE-476 CVE-2022-36013: TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::Conve TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.

CVE-2022-35940 [HIGH] CWE-190 CVE-2022-35940: TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an arg TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used to construct a `TensorShape` as an `int64`. If `limits` is a very large float, it can overflow when converted to an `int64`. This triggers an `InvalidArgument` but also throws an abort signal that crashes the progr

CVE-2022-36015 [HIGH] CWE-190 CVE-2022-36015: TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched the issue in GitHub commit 37e64539cd29fcfb814c4451152a60f5d107b0f0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and Te

CVE-2022-41887 [HIGH] CWE-131 CVE-2022-41887: TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_ TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched the issue in GitHub commit c5b30379ba87cb

CVE-2022-41899 [HIGH] CWE-20 CVE-2022-41899: TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_stat TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10

CVE-2022-41893 [HIGH] CWE-617 CVE-2022-41893: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is give TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We w

CVE-2022-35982 [HIGH] CWE-20 CVE-2022-35982: TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 40adbe4dd15b582b0210dfbf40c243a62f5119fa. The fix wi

CVE-2022-35973 [HIGH] CWE-20 CVE-2022-35973: TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit aca766ac7693bf29ed0df55ad6bfcc78f35e7f48. The fix will be included in TensorFlow 2.10.0

CVE-2023-33976 [HIGH] CWE-190 CVE-2023-33976: TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` cause TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.

CVE-2022-35988 [HIGH] CWE-617 CVE-2022-35988: TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a. The fix will be included in TensorFlow 2.10.0. We will als

CVE-2022-35998 [HIGH] CWE-617 CVE-2022-35998: TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input ` TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c8ba76d48567aed347508e0552a257641931024d. The fix will be included in TensorFlow 2.10

CVE-2022-35997 [HIGH] CWE-617 CVE-2022-35997: TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input ` TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 83dcb4dbfa094e33db084e97c4d0531a559e0ebf. The fix will be included in TensorFlow 2.10.0. We will

CVE-2022-35983 [HIGH] CWE-617 CVE-2022-35983: TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over te TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4. The fix will be included in TensorFlow 2.10.0. We

CVE-2022-35985 [HIGH] CWE-617 CVE-2022-35985: TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255. The fix will be included in TensorFlow 2.10.0. We will

CVE-2022-35994 [HIGH] CWE-617 CVE-2022-35994: TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scal TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c1f491817dec39a26be3c574e86a88c30f3c4770. The fix will be included in TensorFlow 2.10.0. We will also cherrypic

CVE-2022-35984 [HIGH] CWE-617 CVE-2022-35984: TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes ` TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64` results in a mismatched type `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 72180be03447a10810edca700cbc9af690dfeb51. The fix wil