Intel Optimization For Tensorflow vulnerabilities

CVE-2022-41896 [MEDIUM] CWE-1284 `tf.raw_ops.Mfcc` crashes `tf.raw_ops.Mfcc` crashes ### Impact If [`ThreadUnsafeUnigramCandidateSampler`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. ```python import tensorflow as tf tf.raw_ops.Mfcc( spectrogram = [[[1.38, 6.32, 5.75, 9.51]]], sample_rate = 2, upper_frequency_limit = 5.0, lower_frequency_l

CVE-2022-41901 [MEDIUM] CWE-20 `CHECK_EQ` fail via input in `SparseMatrixNNZ` `CHECK_EQ` fail via input in `SparseMatrixNNZ` ### Impact An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in [`tf.raw_ops.SparseMatrixNNZ`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h). ```python import tensorflow as tf tf.raw_ops.SparseMatrixNNZ(sparse_matrix=[]) ``` ### Patches We have patched the issue in Gi

CVE-2022-41890 [MEDIUM] CWE-704 `CHECK` fail in `BCast` overflow `CHECK` fail in `BCast` overflow ### Impact If [`BCast::ToShape`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in [`tf.experimental.numpy.outer`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) by passing in large input to the input

CVE-2022-36004 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` fail in `tf.random.gamma` TensorFlow vulnerable to `CHECK` fail in `tf.random.gamma` ### Impact When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(4,), dtype=tf.int32, maxval=65536) arg_1=tf.random.uniform(shape=(4, 4), dtype=tf.float64, maxval=None) arg_2=tf.random.uniform(shape=(4, 4, 4,

CVE-2022-41886 [MEDIUM] CWE-131 Overflow in `ImageProjectiveTransformV2` Overflow in `ImageProjectiveTransformV2` ### Impact When [`tf.raw_ops.ImageProjectiveTransformV2`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/image_ops.cc) is given a large output shape, it overflows. ```python import tensorflow as tf interpolation = "BILINEAR" fill_mode = "REFLECT" images = tf.constant(0.184634328, shape=[2,5,8,3], dtype=tf.float32) transforms = tf.constant(0.37857

CVE-2022-41891 [MEDIUM] CWE-20 Segfault in `tf.raw_ops.TensorListConcat` Segfault in `tf.raw_ops.TensorListConcat` ### Impact If [`tf.raw_ops.TensorListConcat`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h) is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack. ```python import tensorflow as tf tf.raw_ops.TensorListConcat( input_handle=tf.data.experimental.to_variant(tf.data.Dataset.from_

CVE-2022-35992 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` fail in `TensorListFromTensor` TensorFlow vulnerable to `CHECK` fail in `TensorListFromTensor` ### Impact When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHECK` fail that can trigger a denial of service attack. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(6, 6, 2), dtype=tf.bfloat16, maxval=None) arg_1=tf.random.uniform(shape=(6, 9, 1, 3), dtype=tf.int64, maxval=6

CVE-2022-36002 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` fail in `Unbatch` TensorFlow vulnerable to `CHECK` fail in `Unbatch` ### Impact When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial of service attack. ```python import tensorflow as tf import numpy as np arg_0=tf.constant(value=np.random.random(size=(3, 3, 1)), dtype=tf.float64) arg_1=tf.constant(value=np.random.randint(0,100,size=(3, 3, 1)), dtype=tf.int64) arg_2=tf.constant(value=np.

CVE-2022-35934 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows ### Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor: ```python import tensorflow as tf tf.reshape(tensor=[[1]],shape=tf.constant([0 for i in range(255)], dtype=tf.int64)) ``` This is anot

CVE-2022-36003 [MEDIUM] CWE-617 TensorFlow vulnerable to `CHECK` fail in `RandomPoissonV2` TensorFlow vulnerable to `CHECK` fail in `RandomPoissonV2` ### Impact When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(4,), dtype=tf.int32, maxval=65536) arg_1=tf.random.uniform(shape=(4, 4, 4, 4, 4), dtype=tf.float32, maxval=None) arg_2=0 arg_3=0 arg_4=tf.int32

CVE-2022-41885 [MEDIUM] CWE-131 Overflow in `FusedResizeAndPadConv2D` Overflow in `FusedResizeAndPadConv2D` ### Impact When [`tf.raw_ops.FusedResizeAndPadConv2D`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc) is given a large tensor shape, it overflows. ```python import tensorflow as tf mode = "REFLECT" strides = [1, 1, 1, 1] padding = "SAME" resize_align_corners = False input = tf.constant(147, shape=[3,3,1,1], dtype=tf.float16

CVE-2022-35965 [MEDIUM] CWE-476 TensorFlow vulnerable to segfault in `LowerBound` and `UpperBound` TensorFlow vulnerable to segfault in `LowerBound` and `UpperBound` ### Impact If `LowerBound` or `UpperBound` is given an empty`sorted_inputs` input, it results in a `nullptr` dereference, leading to a segfault that can be used to trigger a denial of service attack. ```python import tensorflow as tf out_type = tf.int32 sorted_inputs = tf.constant([], shape=[10,0], dtype=tf.float32) values = tf.co

CVE-2023-27579 [HIGH] CWE-697 TensorFlow has Floating Point Exception in TFLite in conv kernel TensorFlow has Floating Point Exception in TFLite in conv kernel ### Impact Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. ### Patches We have patched the issue in GitHub commit [34f8368c535253f5c9cb3a303297743b62442aaa](https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa). The fix will be included in TensorFlow 2

CVE-2023-25663 [HIGH] CWE-476 TensorFlow has Null Pointer Error in TensorArrayConcatV2 TensorFlow has Null Pointer Error in TensorArrayConcatV2 ### Impact When ctx->step_containter() is a null ptr, the Lookup function will be executed with a null pointer. ```python import tensorflow as tf tf.raw_ops.TensorArrayConcatV2(handle=['a', 'b'], flow_in = 0.1, dtype=tf.int32, element_shape_except0=1) ``` ### Patches We have patched the issue in GitHub commit [239139d2ae6a81ae9ba499ad78b56d9b2931538a](

CVE-2023-25674 [HIGH] CWE-476 TensorFlow has Null Pointer Error in RandomShuffle with XLA enable TensorFlow has Null Pointer Error in RandomShuffle with XLA enable ### Impact NPE in RandomShuffle with XLA enable ```python import tensorflow as tf func = tf.raw_ops.RandomShuffle para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649} @tf.function(jit_compile=True) def test(): y = func(**para) return y test() ``` ### Patches We have patched the issue in GitHub commit [728113a3be690f

CVE-2023-25658 [HIGH] CWE-125 TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad ### Impact Out of bounds read in GRUBlockCellGrad ```python func = tf.raw_ops.GRUBlockCellGrad para = {'x': [[21.1, 156.2], [83.3, 115.4]], 'h_prev': array([[136.5], [136.6]]), 'w_ru': array([[26.7, 0.8], [47.9, 26.1], [26.2, 26.3]]), 'w_c': array([[ 0.4], [31.5], [ 0.6]]), 'b_ru': array([0.1, 0.2 ], dtype=float32), 'b_c': 0x41414141, 'r'

CVE-2022-41883 [MEDIUM] CWE-125 Out of bounds segmentation fault due to unequal op inputs in Tensorflow Out of bounds segmentation fault due to unequal op inputs in Tensorflow ### Impact [`tf.raw_ops.DynamicStitch`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynamic_stitch_op.cc) specifies input sizes when it is [registered](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flow_ops.cc). ```cpp REGISTER_OP("DynamicStitch") .Input("in

CVE-2023-25672 [HIGH] CWE-476 TensorFlow has Null Pointer Error in LookupTableImportV2 TensorFlow has Null Pointer Error in LookupTableImportV2 ### Impact The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. ```python import tensorflow as tf v = tf.Variable(1) @tf.function(jit_compile=True) def test(): func = tf.raw_ops.LookupTableImportV2 para={'table_handle': v.handle,'keys': [62.98910140991211, 94.36528015136719], 'values': -919}

CVE-2021-29530 [LOW] CWE-476 Invalid validation in `SparseMatrixSparseCholesky` Invalid validation in `SparseMatrixSparseCholesky` ### Impact An attacker can trigger a null pointer dereference by providing an invalid `permutation` to `tf.raw_ops.SparseMatrixSparseCholesky`: ```python import tensorflow as tf import numpy as np from tensorflow.python.ops.linalg.sparse import sparse_csr_matrix_ops indices_array = np.array([[0, 0]]) value_array = np.array([-10.0], dtype=np.float32) dense_shape =

CVE-2021-41220 [HIGH] CWE-416 Use after free / memory leak in `CollectiveReduceV2` Use after free / memory leak in `CollectiveReduceV2` ### Impact The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free: ```python import tensorflow as tf tf.raw_ops.CollectiveReduceV2( input=[], group_size=[-10, -10, -10], group_k