p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in tensorflow-cpu · Seite 14

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für tensorflow-cpu: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 430

  1. CVE-2021-37657

    Hoch · CVSS 7.1EPSS 0,17%Korrektur verfügbar

    Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2021-37658

    Hoch · CVSS 7.1EPSS 0,17%Korrektur verfügbar

    Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2021-37644

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    `std::abort` raised from `TensorListReserve` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to `num_elements` list argument of `tf.raw_ops.TensorListReserve` causes the runtime to abort the process due to reallocating a `std::vector` to have a negative number of elements. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/list_kernels.cc#L312) calls `std::vector.resize()` with the new size controlled by input given by the user, without checking that this input is valid. We have patched the issue in GitHub commit 8a6e874437670045e6c7dc

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2021-37654

    Hoch · CVSS 7.3EPSS 0,17%Korrektur verfügbar

    Heap OOB and CHECK fail in `ResourceGather` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor. Since the implementation uses several for loops over the dimensions of `t

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2021-37641

    Hoch · CVSS 7.3EPSS 0,17%Korrektur verfügbar

    Heap OOB in `RaggedGather` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions if the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by `params_nested_splits` is not an emp

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2021-37635

    Hoch · CVSS 7.3EPSS 0,17%Korrektur verfügbar

    Heap out of bounds access in sparse reduction operations in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_reduce_op.cc#L217-L228) fails to validate that each reduction group does not overflow and that each corresponding index does not point to outside the bounds of the input tensor. We have patched the issue in GitHub commit 87158f43f05f2720a374f3e6d22a7aaa3a33f750. The fix will be included in T

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2021-37664

    Hoch · CVSS 7.3EPSS 0,17%Korrektur verfügbar

    Heap OOB in boosted trees in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) needs to validate that each value in `stats_summary_indices` is in range. We have patched the issue in GitHub commit e84c975313e8e8e38bb2ea118196369c45c51378. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2021-37659

    Hoch · CVSS 7.3EPSS 0,18%Korrektur verfügbar

    Out of bounds read via null pointer dereference in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations). The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/cwise_ops_common.h#L264) assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr. W

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2021-37655

    Hoch · CVSS 7.3EPSS 0,17%Korrektur verfügbar

    Heap OOB in `ResourceScatterUpdate` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L919-L923) has an incomplete validation of the relationship between the shapes of `indices` and `updates`: instead of checking that the shape of `indices` is a prefix of the shape of `updates` (so that broadcasting can happen), code only checks that the nu

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2021-37637

    Hoch · CVSS 7.7EPSS 0,16%Korrektur verfügbar

    Null pointer dereference in `CompressElement` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to `tf.raw_ops.CompressElement`. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/data/compression_utils.cc#L34) was accessing the size of a buffer obtained from the return of a separate function call before validating that said buffer is valid. We have patched the issue in GitHub commit 5dc7f6981fdaf74c8c5be41f393df705841fb7c5. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this com

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2021-37649

    Hoch · CVSS 7.7EPSS 0,16%Korrektur verfügbar

    Null pointer dereference in `UncompressElement` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/compression_ops.cc#L50-L53) obtains a pointer to a `CompressedElement` from a `Variant` tensor and then proceeds to dereference it for decompressing. There is no check that the `Variant` tensor contained a `CompressedElement`, so the pointer is actually `nullptr`. We have patched the issue in GitHub commit 7bdf50bb4f5c54a4997c379092

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2021-37647

    Hoch · CVSS 7.7EPSS 0,16%Korrektur verfügbar

    Null pointer dereference in `SparseTensorSliceDataset` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L240-L251) has some argument validation but fails to consider the case when either `indices` or `values` are provided for an empty sparse tensor when the other is not. If `indices` is empty, then [code that performs validation](https://

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2021-37643

    Hoch · CVSS 7.7EPSS 0,16%Korrektur verfügbar

    Null pointer dereference in `MatrixDiagPartOp` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L89) reads the first value from a tensor buffer without first checking that the tensor has values to read from. We have patched the issue in GitHub commit 482da92095c4d48f8784b1f00dda4f81c28d2988. The f

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2021-37639

    Hoch · CVSS 8.4EPSS 0,17%Korrektur verfügbar

    Null pointer dereference and heap OOB read in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer. Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159) retrieves the tensor list corresponding to the `tensor_name` user controlled input and immediately retrieves the tensor

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2021-37638

    Hoch · CVSS 7.7EPSS 0,17%Korrektur verfügbar

    Null pointer dereference in `RaggedTensorToTensor` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty. We have patched the issue in GitHub commit 301ae88b331d37a2a16159b65b255f4f9eb39314. The fix will be included in TensorFlow 2.6.0. We will a

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2021-37660

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    Division by 0 in inplace operations in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2021-37653

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    Division by 0 in `ResourceGather` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, `batch_size`, and then divides by it without checking that this value is not 0. We have patched the issue in GitHub commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2021-37642

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    Division by 0 in `ResourceScatterDiv` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit 4aacb30888638da75023e6601149415b39763d76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2021-37640

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    Integer division by 0 in sparse reshaping in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2021-37636

    Mittel · CVSS 5.5EPSS 0,15%Korrektur verfügbar

    Floating point exception in `SparseDenseCwiseDiv` in TensorFlow

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, Tenso

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.3 aktualisieren
    • Auf 2.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →