Google Tensorflow vulnerabilities

CVE-2022-35968 [HIGH] CWE-617 CVE-2022-35968: TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in

CVE-2022-35993 [HIGH] CWE-617 CVE-2022-35993: TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_sh TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will al

CVE-2022-35995 [HIGH] CWE-617 CVE-2022-35995: TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf6b45244992e2ee543c258e519489659c99fb7f. The fix will be included in TensorFlow 2.10.0.

CVE-2022-35987 [HIGH] CWE-617 CVE-2022-35987: TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tensor `input` or to be length-0. A different `weights` shape will trigger a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf4c14353c

CVE-2022-35989 [HIGH] CWE-617 CVE-2022-35989: TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size in TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input tensor `input`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 32d7bd3defd134f21a4e344c8dfd40099aaf6b18. The

CVE-2022-36026 [HIGH] CWE-617 CVE-2022-36026: TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We

CVE-2022-36019 [HIGH] CWE-617 CVE-2022-36019: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` i TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included i

CVE-2022-35999 [HIGH] CWE-617 CVE-2022-35999: TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empt TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empty `out_backprop` inputs (e.g. `[3, 1, 0, 1]`), the current CPU/GPU kernels `CHECK` fail (one with dnnl, the other with cudnn). This can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 27a65a43cf763897fecfa5cdb5c

CVE-2022-35963 [HIGH] CWE-617 CVE-2022-35963: TensorFlow is an open source platform for machine learning. The implementation of `FractionalAvgPool TensorFlow is an open source platform for machine learning. The implementation of `FractionalAvgPoolGrad` does not fully validate the input `orig_input_tensor_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 03a659d7be9a1154fdf5eeac

CVE-2022-35959 [HIGH] CWE-617 CVE-2022-35959: TensorFlow is an open source platform for machine learning. The implementation of `AvgPool3DGradOp` TensorFlow is an open source platform for machine learning. The implementation of `AvgPool3DGradOp` does not fully validate the input `orig_input_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 9178ac9d6389bdc54638ab913ea0e419234d14

CVE-2022-35971 [HIGH] CWE-617 CVE-2022-35971: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `m TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10

CVE-2022-35969 [HIGH] CWE-617 CVE-2022-35969: TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInp TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise, it gives a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 50156d547b9a1da0144d7babe665cf690305b33c. The fix will be included

CVE-2023-25676 [HIGH] CWE-476 CVE-2023-25676: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2. TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

CVE-2023-27579 [HIGH] CWE-697 CVE-2023-27579: TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model w TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.

CVE-2022-41911 [HIGH] CWE-704 CVE-2022-41911: TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been p

CVE-2023-25672 [HIGH] CWE-476 CVE-2023-25672: TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImpo TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2023-25667 [HIGH] CWE-190 CVE-2023-25667: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, int TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height * width * channels < 2^32`, for example Full HD screencast of at least 346 frames. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVE-2021-29530 [HIGH] CWE-476 CVE-2021-29530: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a nul TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference by providing an invalid `permutation` to `tf.raw_ops.SparseMatrixSparseCholesky`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/080f1d9e257589f78b3ffb75debf584168aa6062/tensorflow/core/kernels/spa

CVE-2021-29583 [HIGH] CWE-476 CVE-2021-29583: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation(https://github.com/tensorflow/tensorflow/blob/57d86e0db5d13

CVE-2021-29599 [HIGH] CWE-369 CVE-2021-29599: TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `Sp TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `Split` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65). An attacker can craft a model such that `num_splits` would b