Skip to content

Commit 9f0b3c6

Browse files
mihaimaruseactensorflower-gardener
mihaimaruseac
authored and
tensorflower-gardener
committed
Update new security advisories
PiperOrigin-RevId: 390179076 Change-Id: I47d52cf11e356dc6ce2307f25119d6bad79d7bd4
1 parent 8cca9d1 commit 9f0b3c6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+2846
-112
lines changed

‎SECURITY.md

+7-4
Original file line numberDiff line numberDiff line change
@@ -193,13 +193,16 @@ Once an issue is reported, TensorFlow uses the following disclosure process:
193193
that require mitigation before publication, those projects will be notified.
194194
* An advisory is prepared (but not published) which details the problem and
195195
steps for mitigation.
196-
* Wherever possible, fixes are prepared for the last minor release of the two
197-
latest major releases, as well as the master branch. We will attempt to
198-
commit these fixes as soon as possible, and as close together as
199-
possible.
196+
* The vulnerability is fixed and potential workarounds are identified.
197+
* Wherever possible, the fix is also prepared for the branches corresponding to
198+
all releases of TensorFlow at most one year old. We will attempt to commit
199+
these fixes as soon as possible, and as close together as possible.
200200
* Patch releases are published for all fixed released versions, a
201201
notification is sent to [email protected], and the advisory is published.
202202

203+
Note that we mostly do patch releases for security reasons and each version of
204+
TensorFlow is supported for only 1 year after the release.
205+
203206
Past security advisories are listed below. We credit reporters for identifying
204207
security issues, although we keep your name confidential if you request it.
205208

‎tensorflow/security/README.md

+166-108
Large diffs are not rendered by default.

‎tensorflow/security/advisory/tfsa-2021-109.md

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
## TFSA-2021-109: Heap out of bounds access in sparse reduction operations
2+
3+
### CVE Number
4+
CVE-2021-37635
5+
6+
### Impact
7+
The implementation of sparse reduction operations in TensorFlow can trigger
8+
accesses outside of bounds of heap allocated data:
9+
10+
```python
11+
import tensorflow as tf
12+
13+
x = tf.SparseTensor(
14+
indices=[[773, 773, 773], [773, 773, 773]],
15+
values=[1, 1],
16+
dense_shape=[337, 337, 337])
17+
tf.sparse.reduce_sum(x, 1)
18+
```
19+
20+
The
21+
[implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_reduce_op.cc#L217-L228)
22+
fails to validate that each reduction group does not overflow and that each
23+
corresponding index does not point to outside the bounds of the input tensor.
24+
25+
### Patches
26+
We have patched the issue in GitHub commit
27+
[87158f43f05f2720a374f3e6d22a7aaa3a33f750](https://github.com/tensorflow/tensorflow/commit/87158f43f05f2720a374f3e6d22a7aaa3a33f750).
28+
29+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
30+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
31+
also affected and still in supported range.
32+
33+
### For more information
34+
Please consult [our security
35+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
36+
more information regarding the security model and how to contact us with issues
37+
and questions.
38+
39+
### Attribution
40+
This vulnerability has been reported by members of the Aivul Team from Qihoo
41+
360.

‎tensorflow/security/advisory/tfsa-2021-110.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## TFSA-2021-110: Floating point exception in `SparseDenseCwiseDiv`
2+
3+
### CVE Number
4+
CVE-2021-37636
5+
6+
### Impact
7+
The implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a
8+
division by 0 error:
9+
10+
```python
11+
import tensorflow as tf
12+
import numpy as np
13+
14+
tf.raw_ops.SparseDenseCwiseDiv(
15+
sp_indices=np.array([[4]]),
16+
sp_values=np.array([-400]),
17+
sp_shape=np.array([647.]),
18+
dense=np.array([0]))
19+
```
20+
21+
The
22+
[implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56)
23+
uses a common class for all binary operations but fails to treat the division by
24+
0 case separately.
25+
26+
### Patches
27+
We have patched the issue in GitHub commit
28+
[d9204be9f49520cdaaeb2541d1dc5187b23f31d9](https://github.com/tensorflow/tensorflow/commit/d9204be9f49520cdaaeb2541d1dc5187b23f31d9).
29+
30+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
31+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
32+
also affected and still in supported range.
33+
34+
### For more information
35+
Please consult [our security
36+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
37+
more information regarding the security model and how to contact us with issues
38+
and questions.
39+
40+
### Attribution
41+
This vulnerability has been reported by members of the Aivul Team from Qihoo
42+
360.

‎tensorflow/security/advisory/tfsa-2021-111.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## TFSA-2021-111: Null pointer dereference in `CompressElement`
2+
3+
### CVE Number
4+
CVE-2021-37637
5+
6+
### Impact
7+
It is possible to trigger a null pointer dereference in TensorFlow by passing an
8+
invalid input to `tf.raw_ops.CompressElement`:
9+
10+
```python
11+
import tensorflow as tf
12+
13+
tf.raw_ops.CompressElement(components=[[]])
14+
```
15+
16+
The
17+
[implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/data/compression_utils.cc#L34)
18+
was accessing the size of a buffer obtained from the return of a separate
19+
function call before validating that said buffer is valid.
20+
21+
### Patches
22+
We have patched the issue in GitHub commit
23+
[5dc7f6981fdaf74c8c5be41f393df705841fb7c5](https://github.com/tensorflow/tensorflow/commit/5dc7f6981fdaf74c8c5be41f393df705841fb7c5).
24+
25+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
26+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
27+
also affected and still in supported range.
28+
29+
### For more information
30+
Please consult [our security
31+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
32+
more information regarding the security model and how to contact us with issues
33+
and questions.
34+
35+
### Attribution
36+
This vulnerability has been reported by members of the Aivul Team from Qihoo
37+
360. Concurrently, it was resolved in `master` branch as it was also discovered
38+
internally and fixed before the report was handled.

‎tensorflow/security/advisory/tfsa-2021-112.md

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
## TFSA-2021-112: Null pointer dereference in `RaggedTensorToTensor`
2+
3+
### CVE Number
4+
CVE-2021-37638
5+
6+
### Impact
7+
Sending invalid argument for `row_partition_types` of
8+
`tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and
9+
undefined behavior:
10+
11+
```python
12+
import tensorflow as tf
13+
14+
tf.raw_ops.RaggedTensorToTensor(
15+
shape=1,
16+
values=10,
17+
default_value=21,
18+
row_partition_tensors=tf.constant([0,0,0,0]),
19+
row_partition_types=[])
20+
```
21+
22+
The
23+
[implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328)
24+
accesses the first element of a user supplied list of values without validating
25+
that the provided list is not empty.
26+
27+
### Patches
28+
We have patched the issue in GitHub commit
29+
[301ae88b331d37a2a16159b65b255f4f9eb39314](https://github.com/tensorflow/tensorflow/commit/301ae88b331d37a2a16159b65b255f4f9eb39314).
30+
31+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
32+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
33+
also affected and still in supported range.
34+
35+
### For more information
36+
Please consult [our security
37+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
38+
more information regarding the security model and how to contact us with issues
39+
and questions.
40+
41+
### Attribution
42+
This vulnerability has been reported by members of the Aivul Team from Qihoo
43+
360.

‎tensorflow/security/advisory/tfsa-2021-113.md

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
## TFSA-2021-113: Null pointer dereference and heap OOB read in operations restoring tensors
2+
3+
### CVE Number
4+
CVE-2021-37639
5+
6+
### Impact
7+
When restoring tensors via raw APIs, if the tensor name is not provided,
8+
TensorFlow can be tricked into dereferencing a null pointer:
9+
10+
```python
11+
import tensorflow as tf
12+
13+
tf.raw_ops.Restore(
14+
file_pattern=['/tmp'],
15+
tensor_name=[],
16+
default_value=21,
17+
dt=tf.int,
18+
preferred_shard=1)
19+
```
20+
21+
The same undefined behavior can be triggered by `tf.raw_ops.RestoreSlice`:
22+
23+
```python
24+
import tensorflow as tf
25+
26+
tf.raw_ops.RestoreSlice(
27+
file_pattern=['/tmp'],
28+
tensor_name=[],
29+
shape_and_slice='2',
30+
dt=inp.array([tf.int]),
31+
preferred_shard=1)
32+
```
33+
34+
Alternatively, attackers can read memory outside the bounds of heap allocated
35+
data by providing some tensor names but not enough for a successful restoration:
36+
37+
```python
38+
import tensorflow as tf
39+
40+
tf.raw_ops.Restore(
41+
file_pattern=['/tmp'],
42+
tensor_name=['x'],
43+
default_value=21,
44+
dt=tf.int,
45+
preferred_shard=42)
46+
```
47+
48+
The
49+
[implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159)
50+
retrieves the tensor list corresponding to the `tensor_name` user controlled
51+
input and immediately retrieves the tensor at the restoration index (controlled
52+
via `preferred_shard` argument). This occurs without validating that the
53+
provided list has enough values.
54+
55+
If the list is empty this results in dereferencing a null pointer (undefined
56+
behavior). If, however, the list has some elements, if the restoration index is
57+
outside the bounds this results in heap OOB read.
58+
59+
### Patches
60+
We have patched the issue in GitHub commit
61+
[9e82dce6e6bd1f36a57e08fa85af213e2b2f2622](https://github.com/tensorflow/tensorflow/commit/9e82dce6e6bd1f36a57e08fa85af213e2b2f2622).
62+
63+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
64+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
65+
also affected and still in supported range.
66+
67+
### For more information
68+
Please consult [our security
69+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
70+
more information regarding the security model and how to contact us with issues
71+
and questions.
72+
73+
### Attribution
74+
This vulnerability has been reported by members of the Aivul Team from Qihoo
75+
360.

‎tensorflow/security/advisory/tfsa-2021-114.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
## TFSA-2021-114: Integer division by 0 in sparse reshaping
2+
3+
### CVE Number
4+
CVE-2021-37640
5+
6+
### Impact
7+
The implementation of `tf.raw_ops.SparseReshape` can be made to trigger an
8+
integral division by 0 exception:
9+
10+
```python
11+
import tensorflow as tf
12+
13+
tf.raw_ops.SparseReshape(
14+
input_indices = np.ones((1,3)),
15+
input_shape = np.array([1,1,0]),
16+
new_shape = np.array([1,0]))
17+
```
18+
19+
The
20+
[implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181)
21+
calls the reshaping functor whenever there is at least an index in the input but
22+
does not check that shape of the input or the target shape have both a non-zero
23+
number of elements.
24+
25+
The [reshape
26+
functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78)
27+
blindly divides by the dimensions of the target shape. Hence, if this is not
28+
checked, code will result in a division by 0.
29+
30+
### Patches
31+
We have patched the issue in GitHub commit
32+
[4923de56ec94fff7770df259ab7f2288a74feb41](https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41).
33+
34+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
35+
commit on TensorFlow 2.5.1 as this is the other affected version.
36+
37+
### For more information
38+
Please consult [our security
39+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
40+
more information regarding the security model and how to contact us with issues
41+
and questions.
42+
43+
### Attribution
44+
This vulnerability has been reported by members of the Aivul Team from Qihoo
45+
360.

‎tensorflow/security/advisory/tfsa-2021-115.md

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
## TFSA-2021-115: Division by 0 in `ResourceScatterDiv`
2+
3+
### CVE Number
4+
CVE-2021-37642
5+
6+
### Impact
7+
The implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a
8+
division by 0 error:
9+
10+
```python
11+
import tensorflow as tf
12+
13+
v= tf.Variable([1,2,3])
14+
tf.raw_ops.ResourceScatterDiv(
15+
resource=v.handle,
16+
indices=[1],
17+
updates=[0])
18+
```
19+
20+
The
21+
[implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865)
22+
uses a common class for all binary operations but fails to treat the division by
23+
0 case separately.
24+
25+
### Patches
26+
We have patched the issue in GitHub commit
27+
[4aacb30888638da75023e6601149415b39763d76](https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415b39763d76).
28+
29+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
30+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
31+
also affected and still in supported range.
32+
33+
### For more information
34+
Please consult [our security
35+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
36+
more information regarding the security model and how to contact us with issues
37+
and questions.
38+
39+
### Attribution
40+
This vulnerability has been reported by members of the Aivul Team from Qihoo
41+
360.

‎tensorflow/security/advisory/tfsa-2021-116.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
## TFSA-2021-116: Heap OOB in `RaggedGather`
2+
3+
### CVE Number
4+
CVE-2021-37641
5+
6+
### Impact
7+
If the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged
8+
tensor code can trigger a read from outside of bounds of heap allocated buffers.
9+
10+
```python
11+
import tensorflow as tf
12+
13+
tf.raw_ops.RaggedGather(
14+
params_nested_splits = [0,0,0],
15+
params_dense_values = [1,1],
16+
indices = [0,0,9,0,0],
17+
OUTPUT_RAGGED_RANK=0)
18+
```
19+
20+
In debug mode, the same code triggers a `CHECK` failure.
21+
22+
The
23+
[implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70)
24+
directly reads the first dimension of a tensor shape before checking that said
25+
tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the
26+
implementation does not check that the list given by `params_nested_splits` is
27+
not an empty list of tensors.
28+
29+
### Patches
30+
We have patched the issue in GitHub commit
31+
[a2b743f6017d7b97af1fe49087ae15f0ac634373](https://github.com/tensorflow/tensorflow/commit/a2b743f6017d7b97af1fe49087ae15f0ac634373).
32+
33+
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this
34+
commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
35+
also affected and still in supported range.
36+
37+
### For more information
38+
Please consult [our security
39+
guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
40+
more information regarding the security model and how to contact us with issues
41+
and questions.
42+
43+
### Attribution
44+
This vulnerability has been reported by members of the Aivul Team from Qihoo
45+
360.

0 commit comments

Comments
 (0)