CVE-2023-25674: NULL Pointer Dereference (CWE-476)
value: TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-03-25T00:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: Python
Files changed: tensorflow/compiler/tests/tensor_list_ops_test.py, tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc
Commit date: 2023-02-01 15:40:20 -0800
Commit message: [Tensorflow] Fix security vulnerability with TensorListSplitOp

PiperOrigin-RevId: 506441188

Diff: diff --git a/tensorflow/compiler/tests/tensor_list_ops_test.py b/tensorflow/compiler/tests/tensor_list_ops_test.py
index 659d9f41e8d5e..3c9b29b1835c7 100644
--- a/tensorflow/compiler/tests/tensor_list_ops_test.py
+++ b/tensorflow/compiler/tests/tensor_list_ops_test.py
@@ -234,9 +234,20 @@ class ListOpsTest(parameterized.TestCase, xla_test.XLATestCase):
       z = array_ops.zeros_like(l)
       z = list_ops.tensor_list_stack(z, element_dtype=dtypes.float32)
       self.assertAllEqual(z.shape.as_list(), [None])
       self.assertAllEqual(z, [0.0, 0.0])
 
+  def testInvalidSplitLength(self):
+    with self.session(), self.test_scope():
+      tensor_list_split = list_ops.tensor_list_split(
+          tensor=[1], element_shape=[-1], lengths=[0]
+      )
+      with self.assertRaisesRegex(
+          errors.UnimplementedError, "All lengths must be positive"
+      ):
+        self.evaluate(tensor_list_split)
+
+
 if __name__ == "__main__":
   os.environ["TF_XLA_FLAGS"] = ("--tf_xla_min_cluster_size=2 " +
                                 os.environ.get("TF_XLA_FLAGS", ""))
   test.main()
diff --git a/tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc b/tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc
index 980ca07e11719..5d299fde60071 100644
--- a/tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc
+++ b/tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc
@@ -551,10 +551,12 @@ class TensorListSplitOp : public XlaOpKernel {
     int64_t length = lengths[0];
     for (int64_t len : lengths) {
       OP_REQUIRES(ctx, len == length,
                   errors::Unimplemented("All lengths have to be the same"));
     }
+    OP_REQUIRES(ctx, length,
+                errors::Unimplemented("All lengths must be positive"));
     OP_REQUIRES(
         ctx, element_dims[0] % length == 0,
         errors::Unimplemented("Buffer size has to be a multiple of length"));
     std::vector<int64_t> new_dims = {element_dims[0] / length, length};
     for (int i = 1; i < element_dims.size(); i++) {

Fixed code:   def testInvalidSplitLength(self):
    with self.session(), self.test_scope():
      tensor_list_split = list_ops.tensor_list_split(
          tensor=[1], element_shape=[-1], lengths=[0]
      )
      with self.assertRaisesRegex(
          errors.UnimplementedError, "All lengths must be positive"
      ):
        self.evaluate(tensor_list_split)


    OP_REQUIRES(ctx, length,
                errors::Unimplemented("All lengths must be positive"));