Intel Optimization For Tensorflow vulnerabilities
429 known vulnerabilities affecting intel/optimization_for_tensorflow.
Total CVEs
429
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH121MEDIUM200LOW103
Vulnerabilities
Page 17 of 22
CVE-2022-29195P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29195 [MEDIUM] CWE-20 Missing validation causes denial of service via `StagePeek`
Missing validation causes denial of service via `StagePeek`
### Impact
The implementation of [`tf.raw_ops.StagePeek`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/stage_op.cc#L261) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:
```python
import tensorf
ghsaosv
CVE-2022-29199P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29199 [MEDIUM] CWE-20 Missing validation causes denial of service via `LoadAndRemapMatrix`
Missing validation causes denial of service via `LoadAndRemapMatrix`
### Impact
The implementation of [`tf.raw_ops.LoadAndRemapMatrix`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/load_and_remap_matrix_op.cc#L70-L98) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denia
ghsaosv
CVE-2022-29196P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29196 [MEDIUM] CWE-1284 Missing validation causes denial of service via `Conv3DBackpropFilterV2`
Missing validation causes denial of service via `Conv3DBackpropFilterV2`
### Impact
The implementation of [`tf.raw_ops.Conv3DBackpropFilterV2`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/conv_grad_ops_3d.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial
ghsaosv
CVE-2022-29207P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29207 [MEDIUM] CWE-20 Undefined behavior when users supply invalid resource handles
Undefined behavior when users supply invalid resource handles
### Impact
Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:
```python
import tensorflow as tf
tf.raw_ops.QueueIsClosedV2(handle=[])
```
```python
import tensorflow as tf
tf.summary.flush(writer=())
```
In graph mode, it would have been impossible to perform these API calls, but
ghsaosv
CVE-2022-29200P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29200 [MEDIUM] CWE-1284 Missing validation causes denial of service via `LSTMBlockCell`
Missing validation causes denial of service via `LSTMBlockCell`
### Impact
The implementation of [`tf.raw_ops.LSTMBlockCell`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/rnn/lstm_ops.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:
```python
i
ghsaosv
CVE-2022-29197P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29197 [MEDIUM] CWE-20 Missing validation causes denial of service via `UnsortedSegmentJoin`
Missing validation causes denial of service via `UnsortedSegmentJoin`
### Impact
The implementation of [`tf.raw_ops.UnsortedSegmentJoin`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc#L92-L95) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a de
ghsaosv
CVE-2022-29211P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29211 [MEDIUM] CWE-20 Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow
Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow
### Impact
The implementation of [`tf.histogram_fixed_width`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc) is vulnerable to a crash when the values array contain `NaN` elements:
```python
import tensorflow as tf
import numpy a
ghsaosv
CVE-2022-29213P4MEDIUM≥ 0, < 2.6.4≥ 2.7.0, < 2.7.2+1 more2022-05-24
CVE-2022-29213 [MEDIUM] CWE-20 Incomplete validation in signal ops leads to crashes in TensorFlow
Incomplete validation in signal ops leads to crashes in TensorFlow
### Impact
The `tf.compat.v1.signal.rfft2d` and `tf.compat.v1.signal.rfft3d` lack input validation and under certain condition can result in crashes (due to `CHECK`-failures).
### Patches
We have patched the issue in GitHub commit [0a8a781e597b18ead006d19b7d23d0a369e9ad73](https://github.com/tensorflow/tensorflow/commit/0a8a781e597
ghsaosv
CVE-2021-29544P4LOW≥ 2.4.0, < 2.4.22021-05-21
CVE-2021-29544 [LOW] CWE-754 CHECK-fail in `QuantizeAndDequantizeV4Grad`
CHECK-fail in `QuantizeAndDequantizeV4Grad`
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`:
```python
import tensorflow as tf
gradient_tensor = tf.constant([0.0], shape=[1])
input_tensor = tf.constant([0.0], shape=[1])
input_min = tf.constant([[0.0]], shape=[1, 1])
input_max = tf.constant([[0.0]], shape=[1, 1])
tf.raw_ops.QuantizeAndDequantizeV4Grad(
ghsaosv
CVE-2021-41213P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41213 [MEDIUM] CWE-662 Deadlock in mutually recursive `tf.function` objects
Deadlock in mutually recursive `tf.function` objects
### Impact
The [code behind `tf.function` API](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/python/eager/def_function.py#L542) can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive:
```python
import tensorflow as tf
@tf.function()
def fun1(num):
if num == 1:
retu
ghsaosv
CVE-2021-41199P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41199 [MEDIUM] CWE-190 Overflow/crash in `tf.image.resize` when size is large
Overflow/crash in `tf.image.resize` when size is large
### Impact
If `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow.
```python
import tensorflow as tf
import numpy as np
tf.keras.layers.UpSampling2D(
size=1610637938,
data_format='channels_first',
interpolation='bilinear')(np.ones((5,1,1,1)))
```
The number of ele
ghsaosv
CVE-2021-41200P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41200 [MEDIUM] CWE-617 Incomplete validation in `tf.summary.create_file_writer`
Incomplete validation in `tf.summary.create_file_writer`
### Impact
If `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail.
```python
import tensorflow as tf
import numpy as np
tf.summary.create_file_writer(logdir='', flush_millis=np.ones((1,2)))
```
### Patches
We have patched the issue in GitHub commit [874bda09e6702cd50bac90b453b50bcc65b2769e](https://
ghsaosv
CVE-2021-29533P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29533 [LOW] CWE-754 CHECK-fail in DrawBoundingBoxes
CHECK-fail in DrawBoundingBoxes
### Impact
An attacker can trigger a denial of service via a `CHECK` failure by passing an empty image to `tf.raw_ops.DrawBoundingBoxes`:
```python
import tensorflow as tf
images = tf.fill([53, 0, 48, 1], 0.)
boxes = tf.fill([53, 31, 4], 0.)
boxes = tf.Variable(boxes)
boxes[0, 0, 0].assign(3.90621)
tf.raw_ops.DrawBoundingBoxes(images=images, boxes=boxes)
```
This is because the [implementation](https
ghsaosv
CVE-2021-41202P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41202 [MEDIUM] CWE-681 Overflow/crash in `tf.range`
Overflow/crash in `tf.range`
### Impact
While calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows:
```python
import tensorflow as tf
tf.sparse.eye(num_rows=922337203685
ghsaosv
CVE-2021-29542P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29542 [LOW] CWE-131 Heap buffer overflow in `StringNGrams`
Heap buffer overflow in `StringNGrams`
### Impact
An attacker can cause a heap buffer overflow by passing crafted inputs to `tf.raw_ops.StringNGrams`:
```python
import tensorflow as tf
separator = b'\x02\x00'
ngram_widths = [7, 6, 11]
left_pad = b'\x7f\x7f\x7f\x7f\x7f'
right_pad = b'\x7f\x7f\x25\x5d\x53\x74'
pad_width = 50
preserve_short_sequences = True
l = ['', '', '', '', '', '', '', '', '', '', '']
data = tf.constant(l,
ghsaosv
CVE-2021-29575P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29575 [LOW] CWE-119 Overflow/denial of service in `tf.raw_ops.ReverseSequence`
Overflow/denial of service in `tf.raw_ops.ReverseSequence`
### Impact
The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service.
```python
import tensorflow as tf
input = tf.zeros([1, 1, 1], dtype=tf.int32)
seq_lengths = tf.constant([0], shape=[1], dtype=tf.int32)
tf.raw_ops.ReverseSequence(
input=input, seq_lengths=seq_lengths, seq_dim=-2, ba
ghsaosv
CVE-2021-29539P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29539 [LOW] CWE-681 Segfault in tf.raw_ops.ImmutableConst
Segfault in tf.raw_ops.ImmutableConst
### Impact
Calling [`tf.raw_ops.ImmutableConst`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/ImmutableConst) with a `dtype` of `tf.resource` or `tf.variant` results in a segfault in the implementation as code assumes that the tensor contents are pure scalars.
```python
>>> import tensorflow as tf
>>> tf.raw_ops.ImmutableConst(dtype=tf.resource, shape=[], memory_region_name="/tmp/t
ghsaosv
CVE-2021-29567P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29567 [LOW] CWE-617 Lack of validation in `SparseDenseCwiseMul`
Lack of validation in `SparseDenseCwiseMul`
### Impact
Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data:
```python
import tensorflow as tf
indices = tf.constant([], shape=[10, 0], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
shape = tf.constant([0, 0], shape=[2], dtype=
ghsaosv
CVE-2021-29547P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29547 [LOW] CWE-125 Heap out of bounds in `QuantizedBatchNormWithGlobalNormalization`
Heap out of bounds in `QuantizedBatchNormWithGlobalNormalization`
### Impact
An attacker can cause a segfault and denial of service via accessing data outside of bounds in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`:
```python
import tensorflow as tf
t = tf.constant([1], shape=[1, 1, 1, 1], dtype=tf.quint8)
t_min = tf.constant([], shape=[0], dtype=tf.float32)
t_max = tf.constant([], shape
ghsaosv
CVE-2021-41217P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41217 [MEDIUM] CWE-476 Null pointer exception when `Exit` node is not preceded by `Enter` op
Null pointer exception when `Exit` node is not preceded by `Enter` op
### Impact
The [process of building the control flow graph](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/common_runtime/immutable_executor_state.cc#L284-L346) for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not:
``
ghsaosv