p PatchFirst

PatchFirst · Latest vulnerabilities

tensorflow-gpu vulnerabilities · Page 2

Vulnerabilities published for tensorflow-gpu in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 427

  1. CVE-2022-41902

    High · CVSS 7.1EPSS 0.49%Fix available

    Out of bounds write in grappler in Tensorflow

    TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-cqvq-fvhr-v6hc

    Not ratedFix available

    `CHECK` failure in `SobolSample` via missing validation

    ### Impact Another instance of CVE-2022-35935, where `SobolSample` is vulnerable to a denial of service via assumed scalar inputs, was found and fixed. ```python import tensorflow as tf tf.raw_ops.SobolSample(dim=tf.constant([1,0]), num_results=tf.constant([1]), skip=tf.constant([1])) ``` ### Patches We have patched the issue in GitHub commits [c65c67f88ad770662e8f191269a907bf2b94b1bf](https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf) and [02400ea266bd811fc016a848445de1bbff3a23a0](https://github.com/tensorflow/tensorflow/commit/02400ea266bd811fc016a848445de1bbff3a23a0) The fix will be included in Tens

    tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-xf83-q765-xm6m

    Not ratedFix available

    `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode

    ### Impact Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(2, 2, 2), dtype=tf.float16, maxval=None) arg_1=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_2=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_3='' tf.raw_ops.TensorListScatter(tensor=arg_0, indices=arg_1, element_shape=arg_2, name=arg_3) ``` ### Patches We have patched the issue in GitHub commit [bf9932fc907aff0e9e8cccf769e8b00d30fd81a1](https://github.co

    tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2022-41911

    Medium · CVSS 4.8EPSS 0.44%Fix available

    Invalid char to bool conversion when printing a tensor in Tensorflow

    TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2022-41909

    Medium · CVSS 4.8EPSS 0.55%Fix available

    Segfault in `CompositeTensorVariantToComponents` in Tensorflow

    TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2022-41908

    Medium · CVSS 4.8EPSS 0.5%Fix available

    `CHECK` fail via inputs in `PyFunc` in Tensorflow

    TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2022-41907

    Medium · CVSS 4.8EPSS 0.49%Fix available

    Overflow in `ResizeNearestNeighborGrad` in Tensorflow

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2022-41901

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `CHECK_EQ` fail via input in `SparseMatrixNNZ` in Tensorflow

    TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in `tf.raw_ops.SparseMatrixNNZ`. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2022-41900

    High · CVSS 7.1EPSS 0.66%Fix available

    FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow

    TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2022-41899

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `CHECK` fail via inputs in `SdcaOptimizer` in Tensorflow

    TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2022-41898

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `CHECK` fail via inputs in `SparseFillEmptyRowsGrad` in Tensorflow

    TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2022-41897

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `FractionalMaxPoolGrad` Heap out of bounds read in Tensorflow

    TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`, TensorFlow will crash. We have patched the issue in GitHub commit d71090c3e5ca325bdf4b02eb236cfb3ee823e927. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2022-41896

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `tf.raw_ops.Mfcc` crashes in Tensorflow

    TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. We have patched the issue in GitHub commit 39ec7eaf1428e90c37787e5b3fbd68ebd3c48860. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2022-41895

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `MirrorPadGrad` heap out of bounds read in Tensorflow

    TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2022-41893

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in Tensorflow

    TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2022-41891

    Medium · CVSS 4.8EPSS 0.48%Fix available

    Segfault in `tf.raw_ops.TensorListConcat` in Tensorflow

    TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2022-41890

    Medium · CVSS 4.8EPSS 0.49%Fix available

    `CHECK` fail in `BCast` overflow in Tensorflow

    TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in `tf.experimental.numpy.outer` by passing in large input to the input `b`. We have patched the issue in GitHub commit 8310bf8dd188ff780e7fc53245058215a05bdbe5. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2022-41889

    Medium · CVSS 5.5EPSS 0.45%Fix available

    Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

    TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a `nullptr`, which is not caught. An example can be seen in `tf.compat.v1.extract_volume_patches` by passing in quantized tensors as input `ksizes`. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2022-41888

    Medium · CVSS 4.8EPSS 0.49%Fix available

    Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow

    TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow-gpu tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.8.4
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2022-41887

    Medium · CVSS 4.8EPSS 0.49%Fix available

    Overflow in `tf.keras.losses.poisson` in Tensorflow

    TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched the issue in GitHub commit c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 and 2.9.3, as these are also affected and still in supported range. However, we will not cherrypick this commit into TensorFlow 2.8.x, as it depends on Eigen behavior

    tensorflow-gpu tensorflow-gpu tensorflow-gpuPython
    • Update to 2.10.1
    • Update to 2.9.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →