CVE-2022-35986: Insufficient Information (NVD-CWE-noinfo)
value: TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f4fa903593bc39b2f79530a74b8. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-09-16T22:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: Python
Files changed: tensorflow/core/kernels/bincount_op.cc, tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
Commit date: 2022-07-18 14:30:35 -0700
Commit message: Fix RaggedBincount Segmentation Fault from the Splits arg

PiperOrigin-RevId: 461715364

Diff: diff --git a/tensorflow/core/kernels/bincount_op.cc b/tensorflow/core/kernels/bincount_op.cc
index 3a2f490aa5743..193431595b64b 100644
--- a/tensorflow/core/kernels/bincount_op.cc
+++ b/tensorflow/core/kernels/bincount_op.cc
@@ -491,10 +491,13 @@ class RaggedBincountOp : public OpKernel {
 
     int num_rows = splits.size() - 1;
     int num_values = values.size();
     int batch_idx = 0;
 
+    OP_REQUIRES(ctx, splits.size() > 0,
+                errors::InvalidArgument("Splits must be non-empty"));
+
     OP_REQUIRES(ctx, splits(0) == 0,
                 errors::InvalidArgument("Splits must start with 0, not with ",
                                         splits(0)));
 
     OP_REQUIRES(ctx, splits(num_rows) == num_values,
diff --git a/tensorflow/python/kernel_tests/math_ops/bincount_op_test.py b/tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
index a000d777681b9..674cae7bf1642 100644
--- a/tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
+++ b/tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
@@ -732,8 +732,20 @@ class RaggedBincountOpTest(test_util.TensorFlowTestCase,
               size=[1, 1],
               weights=[0, 0, 0],
               binary_output=False,
               name=None))
 
+  @test_util.run_in_graph_and_eager_modes
+  def test_splits_empty(self):  # b/238450914
+    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
+                                "Splits must be non-empty"):
+      self.evaluate(
+          gen_math_ops.ragged_bincount(
+              splits=[],  # Invalid splits
+              values=[1],
+              size=1,
+              weights=[1],
+              binary_output=False,
+              name=None))
 
 if __name__ == "__main__":
   googletest.main()

Fixed code:     OP_REQUIRES(ctx, splits.size() > 0,
                errors::InvalidArgument("Splits must be non-empty"));

  @test_util.run_in_graph_and_eager_modes
  def test_splits_empty(self):  # b/238450914
    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                "Splits must be non-empty"):
      self.evaluate(
          gen_math_ops.ragged_bincount(
              splits=[],  # Invalid splits
              values=[1],
              size=1,
              weights=[1],
              binary_output=False,
              name=None))