Intel Optimization For Tensorflow vulnerabilities
429 known vulnerabilities affecting intel/optimization_for_tensorflow.
Total CVEs
429
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH121MEDIUM200LOW103
Vulnerabilities
Page 8 of 22
CVE-2022-35960P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35960 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` failure in `TensorListReserve` via missing validation
TensorFlow vulnerable to `CHECK` failure in `TensorListReserve` via missing validation
### Impact
In [`core/kernels/list_kernels.cc's TensorListReserve`](https://github.com/tensorflow/tensorflow/blob/c8ba76d48567aed347508e0552a257641931024d/tensorflow/core/kernels/list_kernels.cc#L322-L325), `num_elements` is assumed to be a tensor of size 1. When a `num_elements` of more than
ghsaosv
CVE-2022-36016P3LOW≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-36016 [LOW] CWE-617 TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`
TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`
### Impact
When [`tensorflow::full_type::SubstituteFromAttrs`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc) receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status.
```cpp
Status SubstituteForEach
ghsaosv
CVE-2022-41909P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41909 [MEDIUM] CWE-20 Segfault in `CompositeTensorVariantToComponents`
Segfault in `CompositeTensorVariantToComponents`
### Impact
An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in [`tf.raw_ops.CompositeTensorVariantToComponents`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc).
```python
import tensorflow as tf
encode = tf.raw_ops.EmptyTensorList(element_dtype=tf.int32, element_shape=[10, 15]
ghsaosv
CVE-2022-41908P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41908 [MEDIUM] CWE-20 `CHECK` fail via inputs in `PyFunc`
`CHECK` fail via inputs in `PyFunc`
### Impact
An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in [`tf.raw_ops.PyFunc`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc).
```python
import tensorflow as tf
value = tf.constant(value=[1,2])
token = b'\xb0'
dataType = [tf.int32]
tf.raw_ops.PyFunc(input=value,token=token,Tout=dataType)
```
### Patches
We have p
ghsaosv
CVE-2022-41895P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41895 [MEDIUM] CWE-125 `MirrorPadGrad` heap out of bounds read
`MirrorPadGrad` heap out of bounds read
### Impact
If [`MirrorPadGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given outsize input `paddings`, TensorFlow will give a heap OOB error.
```python
import tensorflow as tf
tf.raw_ops.MirrorPadGrad(input=[1],
paddings=[[0x77f00000,0xa000000]],
mode = 'REFLECT')
```
### Patches
We have patched the issue in GitHub com
ghsaosv
CVE-2022-41898P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41898 [MEDIUM] CWE-20 `CHECK` fail via inputs in `SparseFillEmptyRowsGrad`
`CHECK` fail via inputs in `SparseFillEmptyRowsGrad`
### Impact
If [`SparseFillEmptyRowsGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse_fill_empty_rows_op_gpu.cu.cc) is given empty inputs, TensorFlow will crash.
```python
import tensorflow as tf
tf.raw_ops.SparseFillEmptyRowsGrad(
reverse_index_map=[], grad_values=[], name=None
)
```
### Patches
We have patched the is
ghsaosv
CVE-2022-41897P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41897 [MEDIUM] CWE-125 `FractionalMaxPoolGrad` Heap out of bounds read
`FractionalMaxPoolGrad` Heap out of bounds read
### Impact
If [`FractionMaxPoolGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/fractional_max_pool_op.cc) is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`, TensorFlow will crash.
```python
import tensorflow as tf
tf.raw_ops.FractionMaxPoolGrad(
orig_input = [[[[1, 1, 1, 1, 1]]]],
orig_output = [[[[1, 1, 1]]]
ghsaosv
CVE-2022-41896P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41896 [MEDIUM] CWE-1284 `tf.raw_ops.Mfcc` crashes
`tf.raw_ops.Mfcc` crashes
### Impact
If [`ThreadUnsafeUnigramCandidateSampler`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash.
```python
import tensorflow as tf
tf.raw_ops.Mfcc(
spectrogram = [[[1.38, 6.32, 5.75, 9.51]]],
sample_rate = 2,
upper_frequency_limit = 5.0,
lower_frequency_l
ghsaosv
CVE-2022-41901P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41901 [MEDIUM] CWE-20 `CHECK_EQ` fail via input in `SparseMatrixNNZ`
`CHECK_EQ` fail via input in `SparseMatrixNNZ`
### Impact
An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in [`tf.raw_ops.SparseMatrixNNZ`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h).
```python
import tensorflow as tf
tf.raw_ops.SparseMatrixNNZ(sparse_matrix=[])
```
### Patches
We have patched the issue in Gi
ghsaosv
CVE-2022-41888P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41888 [MEDIUM] CWE-20 FPE in `tf.image.generate_bounding_box_proposals`
FPE in `tf.image.generate_bounding_box_proposals`
### Impact
When running on GPU, [`tf.image.generate_bounding_box_proposals`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc) receives a `scores` input that must be of rank 4 but is not checked.
```python
import tensorflow as tf
a = tf.constant(value=[[1.0, 1.0], [1.0, 1.0], [1.0, 1.0], [1.0, 1.0]])
ghsaosv
CVE-2022-41890P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41890 [MEDIUM] CWE-704 `CHECK` fail in `BCast` overflow
`CHECK` fail in `BCast` overflow
### Impact
If [`BCast::ToShape`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in [`tf.experimental.numpy.outer`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) by passing in large input to the input
ghsaosv
CVE-2022-35970P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35970 [MEDIUM] CWE-20 TensorFlow vulnerable to segfault in `QuantizedInstanceNorm`
TensorFlow vulnerable to segfault in `QuantizedInstanceNorm`
### Impact
If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
output_range_given = False
given_y_min = 0
given_y_max = 0
variance_epsilon = 1e-05
min_separation = 0.001
x = tf.constant(88, shape=[1,4
ghsaosv
CVE-2022-35979P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35979 [MEDIUM] CWE-20 TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`
TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`
### Impact
If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_features`, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
out_type = tf.quint8
features = tf.constant(28, shape=[4,2], dtype=tf.quint8)
min_feature
ghsaosv
CVE-2022-36017P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-36017 [MEDIUM] CWE-20 TensorFlow vulnerable to segfault in `Requantize`
TensorFlow vulnerable to segfault in `Requantize`
### Impact
If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
out_type = tf.quint8
input = tf.constant([1], shape=[3], dtype=tf.qint32)
input_min = tf.constant([], shape=[0], dty
ghsaosv
CVE-2022-35986P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35986 [MEDIUM] TensorFlow vulnerable to segfault in `RaggedBincount`
TensorFlow vulnerable to segfault in `RaggedBincount`
### Impact
If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
binary_output = True
splits = tf.random.uniform(shape=[0], minval=-10000, maxval=10000, dtype=tf.int64, seed=-7430)
values = tf.random.uniform(shape=[], minval=-10000, maxval=10000
ghsaosv
CVE-2022-35974P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35974 [MEDIUM] CWE-20 TensorFlow vulnerable to segfault in `QuantizeDownAndShrinkRange`
TensorFlow vulnerable to segfault in `QuantizeDownAndShrinkRange`
### Impact
If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
out_type = tf.quint8
input = tf.constant([1], shape=[3], dtype=tf.qint32)
input_min = tf.constant([], shape=[0], dtype=
ghsaosv
CVE-2022-41886P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41886 [MEDIUM] CWE-131 Overflow in `ImageProjectiveTransformV2`
Overflow in `ImageProjectiveTransformV2`
### Impact
When [`tf.raw_ops.ImageProjectiveTransformV2`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/image_ops.cc) is given a large output shape, it overflows.
```python
import tensorflow as tf
interpolation = "BILINEAR"
fill_mode = "REFLECT"
images = tf.constant(0.184634328, shape=[2,5,8,3], dtype=tf.float32)
transforms = tf.constant(0.37857
ghsaosv
CVE-2022-41885P3MEDIUM≥ 0, < 2.7.4≥ 2.8.0, < 2.8.1+1 more2022-11-21
CVE-2022-41885 [MEDIUM] CWE-131 Overflow in `FusedResizeAndPadConv2D`
Overflow in `FusedResizeAndPadConv2D`
### Impact
When [`tf.raw_ops.FusedResizeAndPadConv2D`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc) is given a large tensor shape, it overflows.
```python
import tensorflow as tf
mode = "REFLECT"
strides = [1, 1, 1, 1]
padding = "SAME"
resize_align_corners = False
input = tf.constant(147, shape=[3,3,1,1], dtype=tf.float16
ghsaosv
CVE-2022-41891P3MEDIUM≥ 0, < 2.8.4≥ 2.9.0, < 2.9.3+1 more2022-11-21
CVE-2022-41891 [MEDIUM] CWE-20 Segfault in `tf.raw_ops.TensorListConcat`
Segfault in `tf.raw_ops.TensorListConcat`
### Impact
If [`tf.raw_ops.TensorListConcat`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h) is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack.
```python
import tensorflow as tf
tf.raw_ops.TensorListConcat(
input_handle=tf.data.experimental.to_variant(tf.data.Dataset.from_
ghsaosv
CVE-2022-35972P3MEDIUM≥ 0, < 2.7.2≥ 2.8.0, < 2.8.1+1 more2022-09-16
CVE-2022-35972 [MEDIUM] CWE-20 TensorFlow vulnerable to segfault in `QuantizedBiasAdd`
TensorFlow vulnerable to segfault in `QuantizedBiasAdd`
### Impact
If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
out_type = tf.qint32
input = tf.constant([85,170,255], shape=[3], dtype=tf.quint8)
bias = tf.constant(43, shape=[2,3], dty
ghsaosv