fix(deps): update dependency tensorflow to v2.12.1 [security] #53

renovate · 2023-03-16T11:39:10Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
tensorflow	`2.2.0` -> `2.12.1`

GitHub Vulnerability Alerts

CVE-2021-37682

Impact

All TFLite operations that use quantization can be made to use unitialized values. For example:

    const auto* affine_quantization =
        reinterpret_cast<TfLiteAffineQuantization*>(
            filter->quantization.params);

The issue stems from the fact that quantization.params is only valid if quantization.type is different that kTfLiteNoQuantization. However, these checks are missing in large parts of the code.

Patches

We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887,
4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

CVE-2021-37687

Impact

TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation.

Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices.

Similar issue exists in Gather implementation.

import tensorflow as tf
import numpy as np
tf.compat.v1.disable_v2_behavior()

params = tf.compat.v1.placeholder(name="params", dtype=tf.int64, shape=(1,))
indices = tf.compat.v1.placeholder(name="indices", dtype=tf.int64, shape=())

out = tf.gather(params, indices, name='out')

with tf.compat.v1.Session() as sess:
   converter = tf.compat.v1.lite.TFLiteConverter.from_session(sess, [params, indices], [out])
   tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(model_content=tflite_model)
interpreter.allocate_tensors()

input_details = interpreter.get_input_details()
output_details = interpreter.get_output_details()

params_data = np.reshape(np.array([1], dtype=np.int64), newshape=(1,))
indices_data = np.reshape(np.array(-10, dtype=np.int64), newshape=())
interpreter.set_tensor(input_details[0]['index'], params_data)
interpreter.set_tensor(input_details[1]['index'], indices_data)

interpreter.invoke()

Patches

We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yakun Zhang of Baidu Security.

CVE-2021-37683

Impact

The implementation of division in TFLite is vulnerable to a division by 0 error

There is no check that the divisor tensor does not contain zero elements.

Patches

We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

CVE-2021-37680

Impact

The implementation of fully connected layers in TFLite is vulnerable to a division by zero error:

const int batch_size = input_size / filter->dims->data[1];

An attacker can craft a model such that filter->dims->data[1] is 0.

Patches

We have patched the issue in GitHub commit 718721986aa137691ee23f03638867151f74935f.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.

CVE-2021-37685

Impact

TFLite's expand_dims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

  if (axis < 0) { 
    axis = input_dims.size + 1 + axis;
  }   
  TF_LITE_ENSURE(context, axis <= input_dims.size);

  TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
  for (int i = 0; i < output_dims->size; ++i) {
    if (i < axis) {
      output_dims->data[i] = input_dims.data[i];
    } else if (i == axis) {
      output_dims->data[i] = 1;
    } else {
      output_dims->data[i] = input_dims.data[i - 1];
    }
  }

If axis is a large negative value (e.g., -100000), then after the first if it would still be negative. The check following the if statement will pass and the for loop would read one element before the start of input_dims.data (when i = 0).

Patches

We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yakun Zhang of Baidu Security.

CVE-2021-37681

Impact

The implementation of SVDF in TFLite is vulnerable to a null pointer error:

  TfLiteTensor* state = GetVariableInput(context, node, kStateTensor);
  // ...
  GetTensorData<float>(state)

The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.

TfLiteTensor* GetVariableInput(TfLiteContext* context, const TfLiteNode* node,
                               int index) {
  TfLiteTensor* tensor = GetMutableInput(context, node, index);
  return tensor->is_variable ? tensor : nullptr;
}

Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->is_variable expression can also trigger a null pointer exception.

Patches

We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

CVE-2021-37689

Impact

An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:

bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {
  if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==
          *axis.getValues<int>().begin() ||
      *axis.getValues<int>().begin() == -1) {
      // ...
  }
  // ...
}

Patches

We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yakun Zhang of Baidu Security.

CVE-2021-37688

Impact

An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

import tensorflow as tf

model = tf.keras.models.Sequential()
model.add(tf.keras.Input(shape=(1, 2, 3)))
model.add(tf.keras.layers.Dense(0, activation='relu'))

converter = tf.lite.TFLiteConverter.from_keras_model(model)
tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(model_content=tflite_model)
interpreter.allocate_tensors()

interpreter.invoke()

The implementation unconditionally dereferences a pointer.

  if (y4 > 1) {
    // ...
  } else {
    for (int i0 = 0; i0 < y0; ++i0) {
      const T* input2_data_ptr = nullptr;
      for (int i1 = 0; i1 < y1; ++i1) {
        input2_data_ptr = input2_data_reset;
        for (int i2 = 0; i2 < y2; ++i2) {
          scalar_broadcast_f(y3, params, *input1_data_ptr, input2_data_ptr,
                             output_data_ptr);
        }
      }
    }
  }

Patches

We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c.

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yakun Zhang of Baidu Security.

CVE-2023-25658

Impact

Out of bounds read in GRUBlockCellGrad

func = tf.raw_ops.GRUBlockCellGrad

para = {'x': [[21.1, 156.2], [83.3, 115.4]], 'h_prev': array([[136.5],
      [136.6]]), 'w_ru': array([[26.7,  0.8],
      [47.9, 26.1],
      [26.2, 26.3]]), 'w_c': array([[ 0.4],
      [31.5],
      [ 0.6]]), 'b_ru': array([0.1, 0.2 ], dtype=float32), 'b_c': 0x41414141, 'r': array([[0.3],
      [0.4]], dtype=float32), 'u': array([[5.7],
      [5.8]]), 'c': array([[52.9],
      [53.1]]), 'd_h': array([[172.2],
      [188.3 ]])}

Patches

We have patched the issue in GitHub commit ff459137c2716a2a60f7d441b855fcb466d778cb.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx.

CVE-2023-25673

Impact

FPE in TensorListSplit with XLA

import tensorflow as tf

func = tf.raw_ops.TensorListSplit
para = {'tensor': [1], 'element_shape': -1, 'lengths': [0]}

@&#8203;tf.function(jit_compile=True)
def fuzz_jit():
 y = func(**para)
 return y

print(fuzz_jit())

Patches

We have patched the issue in GitHub commit 728113a3be690facad6ce436660a0bc1858017fa.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

CVE-2023-25675

Impact

When running with XLA, tf.raw_ops.Bincount segfaults when given a parameter weights that is neither the same shape as parameter arr nor a length-0 tensor.

import tensorflow as tf

func = tf.raw_ops.Bincount
para={'arr': 6, 'size': 804, 'weights': [52, 351]}

@&#8203;tf.function(jit_compile=True)
def fuzz_jit():
 y = func(**para)
 return y

print(fuzz_jit())

Patches

We have patched the issue in GitHub commit 8ae76cf085f4be26295d2ecf2081e759e04b8acf.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

CVE-2023-25674

Impact

NPE in RandomShuffle with XLA enable

import tensorflow as tf

func = tf.raw_ops.RandomShuffle
para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}

@&#8203;tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit 728113a3be690facad6ce436660a0bc1858017fa.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

CVE-2023-25676

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@&#8203;tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

CVE-2023-25801

Impact

nn_ops.fractional_avg_pool_v2 and nn_ops.fractional_max_pool_v2 require the first and fourth elements of their parameter pooling_ratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported.

import tensorflow as tf
import os
import numpy as np
from tensorflow.python.ops import nn_ops
try:
  arg_0_tensor = tf.random.uniform([3, 30, 50, 3], dtype=tf.float64)
  arg_0 = tf.identity(arg_0_tensor)
  arg_1_0 = 2
  arg_1_1 = 3
  arg_1_2 = 1
  arg_1_3 = 1
  arg_1 = [arg_1_0,arg_1_1,arg_1_2,arg_1_3,]
  arg_2 = True
  arg_3 = True
  seed = 341261001
  out = nn_ops.fractional_avg_pool_v2(arg_0,arg_1,arg_2,arg_3,seed=seed,)
except Exception as e:
  print("Error:"+str(e))

Patches

We have patched the issue in GitHub commit ee50d1e00f81f62a4517453f721c634bbb478307.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was reported by dmc1778, of nimashiri2012@gmail.com.

CVE-2023-25672

Impact

The function tf.raw_ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE.

import tensorflow as tf

v = tf.Variable(1)

@&#8203;tf.function(jit_compile=True)
def test():
   func = tf.raw_ops.LookupTableImportV2
   para={'table_handle': v.handle,'keys': [62.98910140991211, 94.36528015136719], 'values': -919}

   y = func(**para)
   return y

print(test())

Patches

We have patched the issue in GitHub commit 980b22536abcbbe1b4a5642fc940af33d8c19b69.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

CVE-2023-25670

Impact

NPE in QuantizedMatMulWithBiasAndDequantize with MKL enable

import tensorflow as tf

func = tf.raw_ops.QuantizedMatMulWithBiasAndDequantize
para={'a': tf.constant(138, dtype=tf.quint8), 'b': tf.constant(4, dtype=tf.qint8), 'bias': [[31.81644630432129, 47.21876525878906], [109.95201110839844, 152.07968139648438]], 'min_a': 141.5337138686371, 'max_a': [73.84139251708984, 173.15280151367188], 'min_b': [], 'max_b': [[16.128345489501953, 193.26820373535156]], 'min_freezed_output': [], 'max_freezed_output': [115.50032806396484, 156.974853515625], 'Toutput': 1.0, 'transpose_a': True, 'transpose_b': False, 'input_quant_mode': 'MIN_FIRST'}

func(**para)

Patches

We have patched the issue in GitHub commit 8a47a39d9697969206d23a523c977238717e8727.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

CVE-2023-25671

Impact

Out-of-bounds access due to mismatched integer type sizes in ValueMap::Manager::GetValueOrCreatePlaceholder. Bug with tfg-translate call to InitMlir. The problem happens with generic functions, as it is already handled for non-generic functions. This is because they, unlike non-generic functions, are using the "old importer". A better long-term solution may be to have the "new importer" handle generic functions.

Patches

We have patched the issue in GitHub

commit 760322a71ac9033e122ef1f4b1c62813021e5938.
commit 2eedc8f676d2c3b8be9492e547b2bc814c10b367

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

Affiliation

360 AIVul

CVE-2023-27579

Impact

Constructing a tflite model with a paramater filter_input_channel of less than 1 gives a FPE.

Patches

We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.

CVE-2023-25666

Impact

version:2.11.0 //core/ops/audio_ops.cc:70

Status SpectrogramShapeFn(InferenceContext* c) { ShapeHandle input; TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &input)); int32_t window_size; TF_RETURN_IF_ERROR(c->GetAttr("window_size", &window_size)); int32_t stride; TF_RETURN_IF_ERROR(c->GetAttr("stride", &stride)); .....[1]

DimensionHandle input_length = c->Dim(input, 0); DimensionHandle input_channels = c->Dim(input, 1);

DimensionHandle output_length; if (!c->ValueKnown(input_length)) { output_length = c->UnknownDim(); } else { const int64_t input_length_value = c->Value(input_length); const int64_t length_minus_window = (input_length_value - window_size); int64_t output_length_value; if (length_minus_window < 0) { output_length_value = 0; } else { output_length_value = 1 + (length_minus_window / stride); .....[2] } output_length = c->MakeDim(output_length_value); }

Get the value of stride at [1], and the used at [2]

import tensorflow as tf

para = {'input': tf.constant([[14.], [24.]], dtype=tf.float32), 'window_size': 1, 'stride': 0, 'magnitude_squared': False}
func = tf.raw_ops.AudioSpectrogram

@&#8203;tf.function(jit_compile=True)
def fuzz_jit():
   y = func(**para)
   return y

fuzz_jit()

Patches

We have patched the issue in GitHub commit d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

CVE-2023-25664

Impact

import os
os.environ['TF_ENABLE_ONEDNN_OPTS'] = '0'
import tensorflow as tf
print(tf.__version__)
with tf.device("CPU"):
    ksize = [1, 40, 128, 1]
    strides = [1, 128, 128, 30]
    padding = "SAME"
    data_format = "NHWC"
    orig_input_shape = [11, 9, 78, 9]
    grad = tf.saturate_cast(tf.random.uniform([16, 16, 16, 16], minval=-128, maxval=129, dtype=tf.int64), dtype=tf.float32)
    res = tf.raw_ops.AvgPoolGrad(
        ksize=ksize,
        strides=strides,
        padding=padding,
        data_format=data_format,
        orig_input_shape=orig_input_shape,
        grad=grad,
    )

Patches

We have patched the issue in GitHub commit ddaac2bdd099bec5d7923dea45276a7558217e5b.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by [email protected]

CVE-2023-25669

Impact

If the stride and window size are not positive for tf.raw_ops.AvgPoolGrad, it can give an FPE.

import tensorflow as tf
import numpy as np

@&#8203;tf.function(jit_compile=True)
def test():
   y = tf.raw_ops.AvgPoolGrad(orig_input_shape=[1,0,0,0], grad=[[[[0.39117979]]]], ksize=[1,0,0,0], strides=[1,0,0,0], padding="SAME", data_format="NCHW")
   return y

print(test())

Patches

We have patched the issue in GitHub commit 1295ae4dbb52fe06b19733b0257e2340d7b63b8d.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

CVE-2023-25667

Impact

Integer overflow occurs when 2^31 <= num_frames * height * width * channels < 2^32, for example Full HD screencast of at least 346 frames.

import urllib.request
dat = urllib.request.urlopen('https://raw.githubusercontent.com/tensorflow/tensorflow/1c38ad9b78ffe06076745a1ee00cec42f39ff726/tensorflow/core/lib/gif/testdata/3g_multiframe.gif').read()
import tensorflow as tf
tf.io.decode_gif(dat)

Patches

We have patched the issue in GitHub commit 8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Andrei

CVE-2023-25659

Impact

If the parameter indices for DynamicStitch does not match the shape of the parameter data, it can trigger an stack OOB read.

import tensorflow as tf
func = tf.raw_ops.DynamicStitch
para={'indices': [[0xdeadbeef], [405], [519], [758], [1015]], 'data': [[110.27793884277344], [120.29475402832031], [157.2418212890625], [157.2626953125], [188.45382690429688]]}
y = func(**para)

Patches

We have patched the issue in GitHub commit ee004b18b976eeb5a758020af8880236cd707d05.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This has been reported via Google OSS VRP.

CVE-2023-25660

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

CVE-2023-25668

Impact

Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE.
When axis is larger than the dim of input, c->Dim(input,axis) goes out of bound.
Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad operations too.

import tensorflow as tf
@&#8203;tf.function
def test():
    tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
    								   input_min=[1.0],
    								   input_max=[10.0],
    								   signed_input=True,
    								   num_bits=1,
    								   range_given=True,
    								   round_mode='HALF_TO_EVEN',
    								   narrow_range=True,
    								   axis=0x7fffffff)
test()

Patches

We have patched the issue in GitHub commit 7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

CVE-2023-25663

Impact

When ctx->step_containter() is a null ptr, the Lookup function will be executed with a null pointer.

import tensorflow as tf
tf.raw_ops.TensorArrayConcatV2(handle=['a', 'b'], flow_in = 0.1, dtype=tf.int32, element_shape_except0=1)

Patches

We have patched the issue in GitHub commit 239139d2ae6a81ae9ba499ad78b56d9b2931538a.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian

CVE-2023-25662

Impact

TFversion 2.11.0 //tensorflow/core/ops/array_ops.cc:1067 const Tensor* hypothesis_shape_t = c->input_tensor(2); std::vector dims(hypothesis_shape_t->NumElements() - 1); for (int i = 0; i < dims.size(); ++i) { dims[i] = c->MakeDim(std::max(h_values(i), t_values(i))); }

if hypothesis_shape_t is empty, hypothesis_shape_t->NumElements() - 1 will be integer overflow, and the it will deadlock

import tensorflow as tf
para={
    'hypothesis_indices': [[]],
    'hypothesis_values': ['tmp/'],
    'hypothesis_shape': [],
    'truth_indices': [[]],
    'truth_values': [''],
    'truth_shape': [],
    'normalize': False
    }
tf.raw_ops.EditDistance(**para)

Patches

We have patched the issue in GitHub commit 08b8e18643d6dcde00890733b270ff8d9960c56c.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

CVE-2023-25665

Impact

When SparseSparseMaximum is given invalid sparse tensors as inputs, it can give an NPE.

import tensorflow as tf
tf.raw_ops.SparseSparseMaximum(
 a_indices=[[1]],
 a_values =[ 0.1 ],
 a_shape = [2],
 b_indices=[[]],
 b_values =[2 ],
 b_shape = [2],
)

Patches

We have patched the issue in GitHub commit 5e0ecfb42f5f65629fd7a4edd6c4afe7ff0feb04.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

CVE-2023-25661

Impact

A malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack.
To minimize the bug, we built a simple single-layer TensorFlow model containing a Convolution3DTranspose layer, which works well with expected inputs and can be deployed in real-world systems. However, if we call the model with a malicious input which has a zero dimension, it gives Check Failed failure and crashes.

import tensorflow as tf

class MyModel(tf.keras.Model):
    def __init__(self):
        super().__init__()
        self.conv = tf.keras.layers.Convolution3DTranspose(2, [3,3,3], padding="same")
        
    def call(self, input):
        return self.conv(input)
model = MyModel() # Defines a valid model.

x = tf.random.uniform([1, 32, 32, 32, 3], minval=0, maxval=0, dtype=tf.float32) # This is a valid input.
output = model.predict(x)
print(output.shape) # (1, 32, 32, 32, 2)

x = tf.random.uniform([1, 32, 32, 0, 3], dtype=tf.float32) # This is an invalid input.
output = model(x) # crash

This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services.

Patches

We have patched the issue in

GitHub commit 948fe6369a5711d4b4568ea9bbf6015c6dfb77e2
GitHub commit 85db5d07db54b853484bfd358c3894d948c36baf.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

CVE-2022-41894

Impact

The reference kernel of the CONV_3D_TRANSPOSE TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result.

Instead of data_ptr += num_channels; it should be data_ptr += output_num_channels; as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels.

An attacker can craft a model with a specific number of input channels in a way similar to the attached example script. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter (i.e. experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF is used).

import tensorflow as tf
model = tf.keras.Sequential(
    [
        tf.keras.layers.InputLayer(input_shape=(2, 2, 2, 1024), batch_size=1),
        tf.keras.layers.Conv3DTranspose(
            filters=8,
            kernel_size=(2, 2, 2),
            padding="same",
            data_format="channels_last",
        ),
    ]
)

converter = tf.lite.TFLiteConverter.from_keras_model(model)
tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(
    model_content=tflite_model,
    experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF,
)

interpreter.allocate_tensors()
interpreter.set_tensor(
    interpreter.get_input_details()[0]["index"], tf.zeros(shape=[1, 2, 2, 2, 1024])
)
interpreter.invoke()

Patches

We have patched the issue in GitHub commit 72c0bdcb25305b0b36842d746cc61d72658d2941.

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Thibaut Goetghebuer-Planchon, Arm Ltd.

CVE-2023-33976

Impact

array_ops.upper_bound causes a segfault when not given a rank 2 tensor.

Patches

We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586.

The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by dmc1778

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-03-25T00:47:08Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: thc-net/poetry.lock

Updating dependencies
Resolving dependencies...

[SolverProblemError]
The current project's Python requirement (>=3.6.1) is not compatible with some of the required packages Python requirement:
  - tensorflow requires Python >=3.7

Because thc-net depends on tensorflow (2.11.1) which requires Python >=3.7, version solving failed.

renovate · 2024-07-30T21:29:52Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: thc-net/poetry.lock

Creating virtualenv thc-net-fleaqHJg-py3.12 in /home/ubuntu/.cache/pypoetry/virtualenvs
Updating dependencies
Resolving dependencies...

[SolverProblemError]
The current project's Python requirement (>=3.6.1) is not compatible with some of the required packages Python requirement:
  - tensorflow requires Python >=3.8

Because thc-net depends on tensorflow (2.12.1) which requires Python >=3.8, version solving failed.

renovate bot added dep:minor dependencies labels Mar 16, 2023

renovate bot changed the title ~~fix(deps): update dependency tensorflow to v2.3.4 [security]~~ fix(deps): update dependency tensorflow to v2.11.1 [security] Mar 25, 2023

renovate bot force-pushed the renovate/pypi-tensorflow-vulnerability branch from 41d6445 to d446125 Compare March 25, 2023 00:47

renovate bot changed the title ~~fix(deps): update dependency tensorflow to v2.11.1 [security]~~ fix(deps): update dependency tensorflow to v2.11.1 [security] - autoclosed Apr 4, 2024

renovate bot closed this Apr 4, 2024

renovate bot deleted the renovate/pypi-tensorflow-vulnerability branch April 4, 2024 13:46

renovate bot changed the title ~~fix(deps): update dependency tensorflow to v2.11.1 [security] - autoclosed~~ fix(deps): update dependency tensorflow to v2.11.1 [security] Apr 4, 2024

renovate bot reopened this Apr 4, 2024

renovate bot restored the renovate/pypi-tensorflow-vulnerability branch April 4, 2024 18:07

renovate bot force-pushed the renovate/pypi-tensorflow-vulnerability branch from d446125 to 9cdfa4a Compare April 4, 2024 18:07

fix(deps): update dependency tensorflow to v2.12.1 [security]

dbb0f98

renovate bot force-pushed the renovate/pypi-tensorflow-vulnerability branch from 9cdfa4a to dbb0f98 Compare July 30, 2024 21:29

renovate bot changed the title ~~fix(deps): update dependency tensorflow to v2.11.1 [security]~~ fix(deps): update dependency tensorflow to v2.12.1 [security] Jul 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency tensorflow to v2.12.1 [security] #53

fix(deps): update dependency tensorflow to v2.12.1 [security] #53

Uh oh!

renovate bot commented Mar 16, 2023 •

edited

Loading

Uh oh!

renovate bot commented Mar 25, 2023 •

edited

Loading

Uh oh!

renovate bot commented Jul 30, 2024

Uh oh!

Uh oh!

fix(deps): update dependency tensorflow to v2.12.1 [security] #53

Are you sure you want to change the base?

fix(deps): update dependency tensorflow to v2.12.1 [security] #53

Uh oh!

Conversation

renovate bot commented Mar 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Impact

Patches

For more information

Attribution

Affiliation

Impact

Patches

For more information

renovate bot commented Mar 16, 2023 •

edited

Loading