Intel Optimization For Tensorflow vulnerabilities

CVE-2021-37640 [MEDIUM] CWE-369 Integer division by 0 in sparse reshaping Integer division by 0 in sparse reshaping ### Impact The implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception: ```python import tensorflow as tf tf.raw_ops.SparseReshape( input_indices = np.ones((1,3)), input_shape = np.array([1,1,0]), new_shape = np.array([1,0])) ``` The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f

CVE-2021-37653 [MEDIUM] CWE-369 Division by 0 in `ResourceGather` Division by 0 in `ResourceGather` ### Impact An attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`: ```python import tensorflow as tf tensor = tf.constant(value=[[]],shape=(0,1),dtype=tf.uint32) v = tf.Variable(tensor) tf.raw_ops.ResourceGather( resource=v.handle, indices=[0], dtype=tf.uint32, batch_dims=1, validate_indices=False) ``` The [implementation](https://github.com/tensorflow/te

CVE-2022-23578 [MEDIUM] CWE-401 Memory leak in Tensorflow Memory leak in Tensorflow ### Impact If a graph node is invalid, TensorFlow can leak memory in the [implementation of `ImmutableExecutorState::Initialize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/common_runtime/immutable_executor_state.cc#L84-L262): ```cc Status s = params_.create_kernel(n->properties(), &item->kernel); if (!s.ok()) { item->kernel = nullptr; s = AttachDef(s,

CVE-2021-29541 [LOW] CWE-476 Null pointer dereference in `StringNGrams` Null pointer dereference in `StringNGrams` ### Impact An attacker can trigger a dereference of a null pointer in `tf.raw_ops.StringNGrams`: ```python import tensorflow as tf data=tf.constant([''] * 11, shape=[11], dtype=tf.string) splits = [0]*115 splits.append(3) data_splits=tf.constant(splits, shape=[116], dtype=tf.int64) tf.raw_ops.StringNGrams(data=data, data_splits=data_splits, separator=b'Ss', ngram_widths=[7,6,11

CVE-2021-37649 [HIGH] CWE-476 Null pointer dereference in `UncompressElement` Null pointer dereference in `UncompressElement` ### Impact The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference: ```python import tensorflow as tf data = tf.data.Dataset.from_tensors([0.0]) tf.raw_ops.UncompressElement( compressed=tf.data.experimental.to_variant(data), output_types=[tf.int64], output_shapes=[2]) ``` The [implementation](https://github.com/tensorflow/tensorfl

CVE-2020-15213 [MEDIUM] CWE-119 Denial of service in tensorflow-lite Denial of service in tensorflow-lite ### Impact In TensorFlow Lite models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very large value to trigger a large allocation: https://github.com/tensorflow/tensorflow/blob/0e68f

CVE-2020-26268 [MEDIUM] CWE-471 Write to immutable memory region in TensorFlow Write to immutable memory region in TensorFlow ### Impact The `tf.raw_ops.ImmutableConst` operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: ```python >>> import tensorflow as tf >>> with open('/tmp/test.txt','w') as f: f.writ

CVE-2020-26271 [MEDIUM] CWE-125 Heap out of bounds access in MakeEdge in TensorFlow Heap out of bounds access in MakeEdge in TensorFlow ### Impact Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The [`MakeEdge` function](https://github.com/tensorflow/tensorflow/blob/3616708cb866365301d8e67b43b32b46d94b08a0/tensorflow/core/common_runtime/graph_constructor.cc#L1426-L1438) creates an edge between one output tensor of the

CVE-2020-26270 [MEDIUM] CWE-20 CHECK-fail in LSTM with zero-length input in TensorFlow CHECK-fail in LSTM with zero-length input in TensorFlow ### Impact Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a `CHECK` failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. ### Patches We have patched the issue in GitHub commit [14755416e364f17fb1870882