Intel Optimization For Tensorflow vulnerabilities

CVE-2021-41212 [HIGH] CWE-125 Heap OOB read in `tf.ragged.cross` Heap OOB read in `tf.ragged.cross` ### Impact The [shape inference code for `tf.ragged.cross`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/ragged_array_ops.cc#L64) can trigger a read outside of bounds of heap allocated array: ```python import tensorflow as tf @tf.function def test(): y = tf.raw_ops.RaggedCross(ragged_values=[], ragged_row_splits=[], sparse_indices=[[

CVE-2021-41224 [MEDIUM] CWE-125 `SparseFillEmptyRows` heap OOB `SparseFillEmptyRows` heap OOB ### Impact The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L194-L241) of `SparseFillEmptyRows` can be made to trigger a heap OOB access: ```python import tensorflow as tf data=tf.raw_ops.SparseFillEmptyRows( indices=[[0,0],[0,0],[0,0]], values=['ssssssssssssssssssssssssssssssssssssssssssss

CVE-2021-29569 [LOW] CWE-125 Heap out of bounds read in `RequantizationRange` Heap out of bounds read in `RequantizationRange` ### Impact The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs: ```python import tensorflow as tf input = tf.constant([1], shape=[1], dtype=tf.qint32) input_max = tf.constant([], dtype=tf.float32) input_min = tf.constant([], dtype=tf.float32) tf.raw_ops.Requant

CVE-2021-29559 [LOW] CWE-125 Heap OOB access in unicode ops Heap OOB access in unicode ops ### Impact An attacker can access data outside of bounds of heap allocated array in `tf.raw_ops.UnicodeEncode`: ```python import tensorflow as tf input_values = tf.constant([58], shape=[1], dtype=tf.int32) input_splits = tf.constant([[81, 101, 0]], shape=[3], dtype=tf.int32) output_encoding = "UTF-8" tf.raw_ops.UnicodeEncode( input_values=input_values, input_splits=input_splits, output_encoding=output_

CVE-2021-29582 [LOW] CWE-125 Heap OOB read in `tf.raw_ops.Dequantize` Heap OOB read in `tf.raw_ops.Dequantize` ### Impact Due to lack of validation in `tf.raw_ops.Dequantize`, an attacker can trigger a read from outside of bounds of heap allocated data: ```python import tensorflow as tf input_tensor=tf.constant( [75, 75, 75, 75, -6, -9, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10,\ -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10,\ -10, -10, -10, -10, -10, -10, -

CVE-2021-37682 [MEDIUM] CWE-908 Use of unitialized value in TFLite Use of unitialized value in TFLite ### Impact All TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200): ```cc const auto* affine_quantization = reinterpret_cast( filter->quantization.params); ``` The issue stems from the fact that `quantization.param

CVE-2021-37641 [MEDIUM] CWE-125 Heap OOB in `RaggedGather` Heap OOB in `RaggedGather` ### Impact If the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. ```python import tensorflow as tf tf.raw_ops.RaggedGather( params_nested_splits = [0,0,0], params_dense_values = [1,1], indices = [0,0,9,0,0], OUTPUT_RAGGED_RANK=0) ``` In debug mode, the same code triggers a `CHECK` failure. The [implement

CVE-2021-41210 [HIGH] CWE-125 Heap OOB read in `tf.raw_ops.SparseCountSparseOutput` Heap OOB read in `tf.raw_ops.SparseCountSparseOutput` ### Impact The [shape inference functions for `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/ops/count_ops.cc#L43-L50) can trigger a read outside of bounds of heap allocated array: ```python import tensorflow as tf @tf.function def func(): return tf.raw_ops.SparseCountSparseO

CVE-2021-41205 [MEDIUM] CWE-125 Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops ### Impact The [shape inference functions for the `QuantizeAndDequantizeV*` operations](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc) can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: ```python import tensorflo

CVE-2020-15199 [HIGH] CWE-20 Denial of Service in Tensorflow Denial of Service in Tensorflow ### Impact The `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops

CVE-2020-15209 [HIGH] CWE-476 Null pointer dereference in tensorflow-lite Null pointer dereference in tensorflow-lite ### Impact A crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`: https://github.com/ten

CVE-2021-29601 [MEDIUM] CWE-190 Integer overflow in TFLite concatentation Integer overflow in TFLite concatentation ### Impact The TFLite implementation of concatenation is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite/kernels/concatenation.cc#L70-L76): ```cc for (int d = 0; d dims->size; ++d) { if (d == axis) { sum_axis += t->dims->data[axis]; } else { TF_LITE_ENSURE_EQ(context, t->dims->data[d]

CVE-2021-37690 [MEDIUM] CWE-416 Use after free and segfault in shape inference functions Use after free and segfault in shape inference functions ### Impact When running shape functions, some functions (such as `MutableHashTableShape`) produce extra output information in the form of a `ShapeAndType` struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a s

CVE-2020-15194 [MEDIUM] CWE-20 Denial of Service in Tensorflow Denial of Service in Tensorflow ### Impact The `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L235-L241 Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of prop

CVE-2020-15198 [MEDIUM] CWE-119 Heap buffer overflow in Tensorflow Heap buffer overflow in Tensorflow ### Impact The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as the `values` one. The values in these tensors are always accessed in parallel: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/ke

CVE-2021-41227 [MEDIUM] CWE-125 Arbitrary memory read in `ImmutableConst` Arbitrary memory read in `ImmutableConst` ### Impact The `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents: ```python import tensorflow as tf with open('/tmp/test','wb') as f: f.write(b'\xe2'*128) data = tf.raw_ops.ImmutableConst(dtype=tf.string,shape=3,memory_region_name='/tmp/test') print(data) ``` This is because the `tstring` TensorFlow string class has a special case f

CVE-2021-37687 [MEDIUM] CWE-125 Heap OOB in TFLite's `Gather*` implementations Heap OOB in TFLite's `Gather*` implementations ### Impact TFLite's [`GatherNd` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather_nd.cc#L124) does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in `indi

CVE-2020-15204 [MEDIUM] CWE-476 Segfault in Tensorflow Segfault in Tensorflow ### Impact In eager mode, TensorFlow does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/session_ops.cc#L45 In the above snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately

CVE-2021-37643 [HIGH] CWE-476 Null pointer dereference in `MatrixDiagPartOp` Null pointer dereference in `MatrixDiagPartOp` ### Impact If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first: ```python import tensorflow as tf tf.raw_ops.MatrixDiagPartV2( input=tf.ones(2,dtype=tf.int32), k=tf.ones(2,dtype=tf.int32), padding_value=[])

CVE-2020-15190 [MEDIUM] CWE-20 Segfault in Tensorflow Segfault in Tensorflow ### Impact The [`tf.raw_ops.Switch`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/Switch) operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295