Intel Optimization For Tensorflow vulnerabilities

CVE-2020-15265 [HIGH] CWE-125 Segfault in `tf.quantization.quantize_and_dequantize` Segfault in `tf.quantization.quantize_and_dequantize` ### Impact An attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`: ```python tf.quantization.quantize_and_dequantize( input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10) ``` This results in accessing [a dimension outside the rank of the input tensor](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc1

CVE-2023-25665 [HIGH] CWE-476 TensorFlow has Null Pointer Error in SparseSparseMaximum TensorFlow has Null Pointer Error in SparseSparseMaximum ### Impact When `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give an NPE. ```python import tensorflow as tf tf.raw_ops.SparseSparseMaximum( a_indices=[[1]], a_values =[ 0.1 ], a_shape = [2], b_indices=[[]], b_values =[2 ], b_shape = [2], ) ``` ### Patches We have patched the issue in GitHub commit [5e0ecfb42f5f65629fd7a4edd6

CVE-2022-35981 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad` TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad` ### Impact `FractionalMaxPoolGrad` validates its inputs with `CHECK` failures instead of with returning errors. If it gets incorrectly sized inputs, the `CHECK` failure can be used to trigger a denial of service attack: ```python import tensorflow as tf overlapping = True orig_input = tf.constant(.453409232, shape=[1,7,13,1], dtype=tf

CVE-2023-25662 [HIGH] CWE-190 TensorFlow vulnerable to integer overflow in EditDistance TensorFlow vulnerable to integer overflow in EditDistance ### Impact TFversion 2.11.0 //tensorflow/core/ops/array_ops.cc:1067 const Tensor* hypothesis_shape_t = c->input_tensor(2); std::vector dims(hypothesis_shape_t->NumElements() - 1); for (int i = 0; i MakeDim(std::max(h_values(i), t_values(i))); } if hypothesis_shape_t is empty, hypothesis_shape_t->NumElements() - 1 will be integer overflow, and the it

CVE-2021-29529 [LOW] CWE-131 Heap buffer overflow caused by rounding Heap buffer overflow caused by rounding ### Impact An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` by manipulating input values so that float rounding results in off-by-one error in accessing image elements: ```python import tensorflow as tf l = [256, 328, 361, 17, 361, 361, 361, 361, 361, 361, 361, 361, 361, 361, 384] images = tf.constant(l, shape=[1, 1, 15, 1], dtype=tf.qint32) size =

CVE-2021-29607 [MEDIUM] CWE-754 Incomplete validation in `SparseSparseMinimum` Incomplete validation in `SparseSparseMinimum` ### Impact Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data: ```python import tensorflow as tf a_indices = tf.ones([45, 92], dtype=tf.int64) a_values = tf.ones([45], dtype=tf.int64) a_shape = tf.ones([1], dtype=tf.int64) b_indices = tf

CVE-2021-29609 [MEDIUM] CWE-665 Incomplete validation in `SparseAdd` Incomplete validation in `SparseAdd` ### Impact Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data: ```python import tensorflow as tf a_indices = tf.zeros([10, 97], dtype=tf.int64) a_values = tf.zeros([10], dtype=tf.int64) a_shape = tf.zeros([0], dtype=tf.int64) b_indices = tf.zeros([0, 0], d

CVE-2021-29520 [LOW] CWE-120 Heap buffer overflow in `Conv3DBackprop*` Heap buffer overflow in `Conv3DBackprop*` ### Impact Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows: ```python import tensorflow as tf input_sizes = tf.constant([1, 1, 1, 1, 2], shape=[5], dtype=tf.int32) filter_tensor = tf.constant([734.6274508233133, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0,

CVE-2021-29579 [LOW] CWE-119 Heap buffer overflow in `MaxPoolGrad` Heap buffer overflow in `MaxPoolGrad` ### Impact The implementation of `tf.raw_ops.MaxPoolGrad` is vulnerable to a heap buffer overflow: ```python import tensorflow as tf orig_input = tf.constant([0.0], shape=[1, 1, 1, 1], dtype=tf.float32) orig_output = tf.constant([0.0], shape=[1, 1, 1, 1], dtype=tf.float32) grad = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32) ksize = [1, 1, 1, 1] strides = [1, 1, 1, 1] padding = "SA

CVE-2021-29512 [LOW] CWE-120 Heap buffer overflow in `RaggedBinCount` Heap buffer overflow in `RaggedBinCount` ### Impact If the `splits` argument of `RaggedBincount` does not specify a valid [`SparseTensor`](https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow: ```python import tensorflow as tf tf.raw_ops.RaggedBincount(splits=[0], values=[1,1,1,1,1], size=5, weights=[1,2,3,4], binary_output=False) ``` This will cause a read

CVE-2021-29535 [LOW] CWE-131 Heap buffer overflow in `QuantizedMul` Heap buffer overflow in `QuantizedMul` ### Impact An attacker can cause a heap buffer overflow in `QuantizedMul` by passing in invalid thresholds for the quantization: ```python import tensorflow as tf x = tf.constant([256, 328], shape=[1, 2], dtype=tf.quint8) y = tf.constant([256, 328], shape=[1, 2], dtype=tf.quint8) min_x = tf.constant([], dtype=tf.float32) max_x = tf.constant([], dtype=tf.float32) min_y = tf.constant([], d

CVE-2021-29537 [LOW] CWE-131 Heap buffer overflow in `QuantizedResizeBilinear` Heap buffer overflow in `QuantizedResizeBilinear` ### Impact An attacker can cause a heap buffer overflow in `QuantizedResizeBilinear` by passing in invalid thresholds for the quantization: ```python import tensorflow as tf images = tf.constant([], shape=[0], dtype=tf.qint32) size = tf.constant([], shape=[0], dtype=tf.int32) min = tf.constant([], dtype=tf.float32) max = tf.constant([], dtype=tf.float32) tf.raw_ops

CVE-2021-29576 [LOW] CWE-119 Heap buffer overflow in `MaxPool3DGradGrad` Heap buffer overflow in `MaxPool3DGradGrad` ### Impact The implementation of `tf.raw_ops.MaxPool3DGradGrad` is vulnerable to a heap buffer overflow: ```python import tensorflow as tf values = [0.01] * 11 orig_input = tf.constant(values, shape=[11, 1, 1, 1, 1], dtype=tf.float32) orig_output = tf.constant([0.01], shape=[1, 1, 1, 1, 1], dtype=tf.float32) grad = tf.constant([0.01], shape=[1, 1, 1, 1, 1], dtype=tf.float32) ks

CVE-2021-29536 [LOW] CWE-787 Heap buffer overflow in `QuantizedReshape` Heap buffer overflow in `QuantizedReshape` ### Impact An attacker can cause a heap buffer overflow in `QuantizedReshape` by passing in invalid thresholds for the quantization: ```python import tensorflow as tf tensor = tf.constant([], dtype=tf.qint32) shape = tf.constant([], dtype=tf.int32) input_min = tf.constant([], dtype=tf.float32) input_max = tf.constant([], dtype=tf.float32) tf.raw_ops.QuantizedReshape(tensor=tenso

CVE-2021-41203 [HIGH] CWE-190 Missing validation during checkpoint loading Missing validation during checkpoint loading ### Impact An attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. ### Patches We have patched the issue in GitHub commits [b619c6f865715ca3b15ef1842b5b95edbaa710ad](h

CVE-2021-37679 [HIGH] CWE-125 Heap OOB in nested `tf.map_fn` with `RaggedTensor`s Heap OOB in nested `tf.map_fn` with `RaggedTensor`s ### Impact It is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap: ```python import tensorflow as tf x = tf.ragged.constant([[1,2,3], [4,

CVE-2021-37652 [HIGH] CWE-415 Use after free in boosted trees creation Use after free in boosted trees creation ### Impact The implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments: ```python import tensorflow as tf v= tf.Variable([0.0]) tf.raw_ops.BoostedTreesCreateEnsemble( tree_ensemble_handle=v.handle, stamp_token=[0], tree_ensemble_serialized=['0']) ``` The [implementation](https://github.com/t

CVE-2021-41216 [MEDIUM] CWE-120 Heap buffer overflow in `Transpose` Heap buffer overflow in `Transpose` ### Impact The [shape inference function for `Transpose`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc#L121-L185) is vulnerable to a heap buffer overflow: ```python import tensorflow as tf @tf.function def test(): y = tf.raw_ops.Transpose(x=[1,2,3,4],perm=[-10]) return y test() ``` This occurs whenever `perm` contai

CVE-2022-23591 [HIGH] CWE-400 Stack overflow in TensorFlow Stack overflow in TensorFlow ### Impact The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`: ``` library { function { signature { name: "SomeOp" description: "Self recursive op" } node_def { name: "1" op: "SomeOp" } node_def { name: "2" op: "SomeOp"

CVE-2018-8825 [HIGH] CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). Users passing a malformed or malicious version of a TFLite graph into TOCO will cause TOCO to crash or cause a buffer overflow, potentially allowing malicious code to be ex