Google Tensorflow vulnerabilities

CVE-2022-41893 [HIGH] CWE-617 CVE-2022-41893: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is give TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We w

CVE-2022-35967 [HIGH] CWE-20 CVE-2022-35967: TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` o TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89. The fix will be included in TensorFlow 2.10.0.

CVE-2022-35972 [HIGH] CWE-20 CVE-2022-35972: TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_inpu TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be inclu

CVE-2022-35966 [HIGH] CWE-20 CVE-2022-35966: TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_inpu TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7cdf9d4d2083b739ec81cfdace546b0c99f50622. The fix will be included in TensorFlow 2.10

CVE-2022-35964 [HIGH] CWE-20 CVE-2022-35964: TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 2a458fc4866505be27c62f81474ecb2b870498fa. The fix will be included in TensorFlow 2.10.0. We

CVE-2022-35988 [HIGH] CWE-617 CVE-2022-35988: TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a. The fix will be included in TensorFlow 2.10.0. We will als

CVE-2022-35998 [HIGH] CWE-617 CVE-2022-35998: TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input ` TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c8ba76d48567aed347508e0552a257641931024d. The fix will be included in TensorFlow 2.10

CVE-2022-35997 [HIGH] CWE-617 CVE-2022-35997: TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input ` TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 83dcb4dbfa094e33db084e97c4d0531a559e0ebf. The fix will be included in TensorFlow 2.10.0. We will

CVE-2022-35983 [HIGH] CWE-617 CVE-2022-35983: TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over te TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4. The fix will be included in TensorFlow 2.10.0. We

CVE-2022-35985 [HIGH] CWE-617 CVE-2022-35985: TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255. The fix will be included in TensorFlow 2.10.0. We will

CVE-2022-36005 [HIGH] CWE-617 CVE-2022-36005: TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_mi TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is nonscalar, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit f3cf67ac5705f4f04721d15e485e192bb319feed. The fix will be included in T

CVE-2022-35994 [HIGH] CWE-617 CVE-2022-35994: TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scal TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c1f491817dec39a26be3c574e86a88c30f3c4770. The fix will be included in TensorFlow 2.10.0. We will also cherrypic

CVE-2022-36001 [HIGH] CWE-617 CVE-2022-36001: TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an inp TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. The fix will be included in TensorFlow 2.10.0. We will als

CVE-2022-35984 [HIGH] CWE-617 CVE-2022-35984: TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes ` TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64` results in a mismatched type `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 72180be03447a10810edca700cbc9af690dfeb51. The fix wil

CVE-2022-35968 [HIGH] CWE-617 CVE-2022-35968: TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in

CVE-2022-35993 [HIGH] CWE-617 CVE-2022-35993: TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_sh TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will al

CVE-2022-35995 [HIGH] CWE-617 CVE-2022-35995: TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf6b45244992e2ee543c258e519489659c99fb7f. The fix will be included in TensorFlow 2.10.0.

CVE-2022-35987 [HIGH] CWE-617 CVE-2022-35987: TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tensor `input` or to be length-0. A different `weights` shape will trigger a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf4c14353c

CVE-2022-35989 [HIGH] CWE-617 CVE-2022-35989: TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size in TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input tensor `input`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 32d7bd3defd134f21a4e344c8dfd40099aaf6b18. The

CVE-2022-36026 [HIGH] CWE-617 CVE-2022-36026: TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We