Intel Optimization For Tensorflow vulnerabilities
429 known vulnerabilities affecting intel/optimization_for_tensorflow.
Total CVEs
429
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH121MEDIUM200LOW103
Vulnerabilities
Page 10 of 22
CVE-2021-29599P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29599 [LOW] CWE-369 Division by zero in TFLite's implementation of Split
Division by zero in TFLite's implementation of Split
### Impact
The implementation of the `Split` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65):
```cc
TF_LITE_ENSURE_MSG(context, input_size % num_splits == 0, "Not an even split");
const int slice_size = input_size / num_sp
ghsaosv
CVE-2021-41220P3HIGH≥ 2.6.0, < 2.6.12021-11-10
CVE-2021-41220 [HIGH] CWE-416 Use after free / memory leak in `CollectiveReduceV2`
Use after free / memory leak in `CollectiveReduceV2`
### Impact
The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:
```python
import tensorflow as tf
tf.raw_ops.CollectiveReduceV2(
input=[],
group_size=[-10, -10, -10],
group_k
ghsaosv
CVE-2021-29513P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29513 [LOW] CWE-476 Type confusion during tensor casts lead to dereferencing null pointers
Type confusion during tensor casts lead to dereferencing null pointers
### Impact
Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences.
There are multiple ways to reproduce this, listing a few examples here:
```python
import tensorflow as tf
import numpy as np
data = tf.random.truncated_normal(shape=1,mean=np.floa
ghsaosv
CVE-2021-29595P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29595 [LOW] CWE-369 Division by zero in TFLite's implementation of `DepthToSpace`
Division by zero in TFLite's implementation of `DepthToSpace`
### Impact
The implementation of the `DepthToSpace` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/depth_to_space.cc#L63-L69):
```cc
const int block_size = params->block_size;
...
const int input_channels = input->dims->d
ghsaosv
CVE-2021-29525P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29525 [LOW] CWE-369 Division by 0 in `Conv2DBackpropInput`
Division by 0 in `Conv2DBackpropInput`
### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropInput`:
```python
import tensorflow as tf
input_tensor = tf.constant([52, 1, 1, 5], shape=[4], dtype=tf.int32)
filter_tensor = tf.constant([], shape=[0, 1, 5, 0], dtype=tf.float32)
out_backprop = tf.constant([], shape=[52, 1, 1, 0], dtype=tf.float32)
tf.raw_ops.Conv2DBackpropInput(input_sizes=input_tensor, f
ghsaosv
CVE-2021-29593P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29593 [LOW] CWE-369 Division by zero in TFLite's implementation of `BatchToSpaceNd`
Division by zero in TFLite's implementation of `BatchToSpaceNd`
### Impact
The implementation of the `BatchToSpaceNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/b5ed552fe55895aee8bd8b191f744a069957d18d/tensorflow/lite/kernels/batch_to_space_nd.cc#L81-L82):
```cc
TF_LITE_ENSURE_EQ(context, output_batch_size % block_shape[dim], 0);
output_bat
ghsaosv
CVE-2021-29589P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29589 [LOW] CWE-369 Division by zero in TFLite's implementation of `GatherNd`
Division by zero in TFLite's implementation of `GatherNd`
### Impact
The reference implementation of the `GatherNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/reference_ops.h#L966):
```cc
ret.dims_to_count[i] = remain_flat_size / params_shape.Dims(i);
```
An atta
ghsaosv
CVE-2021-29585P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29585 [LOW] CWE-369 Division by zero in padding computation in TFLite
Division by zero in padding computation in TFLite
### Impact
The TFLite computation for size of output after padding, [`ComputeOutSize`](https://github.com/tensorflow/tensorflow/blob/0c9692ae7b1671c983569e5d3de5565843d500cf/tensorflow/lite/kernels/padding.h#L43-L55), does not check that the `stride` argument is not 0 before doing the division.
```cc
inline int ComputeOutSize(TfLitePadding padding, int image_size,
in
ghsaosv
CVE-2021-29594P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29594 [LOW] CWE-369 Division by zero in TFLite's convolution code
Division by zero in TFLite's convolution code
### Impact
TFLite's [convolution code](https://github.com/tensorflow/tensorflow/blob/09c73bca7d648e961dd05898292d91a8322a9d45/tensorflow/lite/kernels/conv.cc) has multiple division where the divisor is controlled by the user and not checked to be non-zero. For example:
```cc
const int input_size = NumElements(input) / SizeOfDimension(input, 0);
```
### Patches
We have patch
ghsaosv
CVE-2021-29587P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29587 [LOW] CWE-369 Division by zero in TFLite's implementation of `SpaceToDepth`
Division by zero in TFLite's implementation of `SpaceToDepth`
### Impact
The `Prepare` step of the `SpaceToDepth` TFLite operator [does not check for 0 before division](https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/space_to_depth.cc#L63-L67).
```cc
const int block_size = params->block_size;
const int input_height = input->dims->data[1];
con
ghsaosv
CVE-2021-29546P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29546 [LOW] CWE-369 Division by 0 in `QuantizedBiasAdd`
Division by 0 in `QuantizedBiasAdd`
### Impact
An attacker can trigger an integer division by zero undefined behavior in `tf.raw_ops.QuantizedBiasAdd`:
```python
import tensorflow as tf
input_tensor = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.quint8)
bias = tf.constant([], shape=[0], dtype=tf.quint8)
min_input = tf.constant(-10.0, dtype=tf.float32)
max_input = tf.constant(-10.0, dtype=tf.float32)
min_bias = tf.constant(-10.0,
ghsaosv
CVE-2021-29600P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29600 [LOW] CWE-369 Division by zero in TFLite's implementation of `OneHot`
Division by zero in TFLite's implementation of `OneHot`
### Impact
The implementation of the `OneHot` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/f61c57bd425878be108ec787f4d96390579fb83e/tensorflow/lite/kernels/one_hot.cc#L68-L72):
```cc
int prefix_dim_size = 1;
for (int i = 0; i dims->data[i];
}
const int suffix_dim_size = NumElements(op_context.in
ghsaosv
CVE-2021-29597P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29597 [LOW] CWE-369 Division by zero in TFLite's implementation of `SpaceToBatchNd`
Division by zero in TFLite's implementation of `SpaceToBatchNd`
### Impact
The implementation of the `SpaceToBatchNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/412c7d9bb8f8a762c5b266c9e73bfa165f29aac8/tensorflow/lite/kernels/space_to_batch_nd.cc#L82-L83):
```cc
TF_LITE_ENSURE_EQ(context, final_dim_size % block_shape[dim], 0);
output_size->
ghsaosv
CVE-2021-29598P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29598 [LOW] CWE-369 Division by zero in TFLite's implementation of `SVDF`
Division by zero in TFLite's implementation of `SVDF`
### Impact
The implementation of the `SVDF` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/7f283ff806b2031f407db64c4d3edcda8fb9f9f5/tensorflow/lite/kernels/svdf.cc#L99-L102):
```cc
const int rank = params->rank;
...
TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);
```
An attacker can craft a model
ghsaosv
CVE-2021-29515P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29515 [LOW] CWE-476 Reference binding to null pointer in `MatrixDiag*` ops
Reference binding to null pointer in `MatrixDiag*` ops
### Impact
The implementation of [`MatrixDiag*` operations](https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty:
```cc
num_rows = context->input(2).flat()(0);
num_cols = context->input(3).flat()(0);
padding
ghsaosv
CVE-2021-29596P3LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29596 [LOW] CWE-369 Division by zero in TFLite's implementation of `EmbeddingLookup`
Division by zero in TFLite's implementation of `EmbeddingLookup`
The implementation of the `EmbeddingLookup` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e4b29809543b250bc9b19678ec4776299dd569ba/tensorflow/lite/kernels/embedding_lookup.cc#L73-L74):
```cc
const int row_size = SizeOfDimension(value, 0);
const int row_bytes = value->bytes / row
ghsaosv
CVE-2021-41225P3MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41225 [MEDIUM] CWE-908 A use of uninitialized value vulnerability in Tensorflow
A use of uninitialized value vulnerability in Tensorflow
### Impact
TensorFlow's Grappler optimizer has a [use of unitialized variable](https://github.com/tensorflow/tensorflow/blob/3457a2b122e50b4d44ceaaed5a663d635e5c22df/tensorflow/core/grappler/optimizers/auto_parallel.cc#L155-L164):
```cc
const NodeDef* dequeue_node;
for (const auto& train_node : train_nodes) {
if (IsDequeueOp(*train_node)) {
dequeue_n
ghsaosv
CVE-2021-37662P3MEDIUM≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37662 [MEDIUM] CWE-824 Reference binding to nullptr in boosted trees
Reference binding to nullptr in boosted trees
### Impact
An attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature`:
```python
import tensorflow as tf
tf.raw_ops.BoostedTreesCalculateBestGainsPerFeature(
node_id_range=[],
stats_summary_list=[[1,2,3]],
l1=[1.0],
l2=[1.0],
tree_complexity =[1.0],
min_node_weight =[1.17],
max_splits=5)
```
A similar att
ghsaosv
CVE-2021-37665P3HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37665 [HIGH] CWE-20 Incomplete validation in MKL requantization
Incomplete validation in MKL requantization
### Impact
Due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:
```python
import tensorflow as tf
tf.raw_ops.RequantizationRangePerChannel(
input=[],
input_min=[0,0,0,0,0],
input_max=[1,1,1,1,1],
clip_value_max=1)
ghsaosv
CVE-2021-37659P3HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37659 [HIGH] CWE-125 Reference binding to nullptr and heap OOB in binary cwise ops
Reference binding to nullptr and heap OOB in binary cwise ops
### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations):
```python
import tensorflow as tf
tf.raw_ops.SqrtGrad(y=[4, 16],dy=[])
```
The [implementation](https://github.com/tensorflow/tensorflow/blob
ghsaosv