CVE-2023-25662 (Python, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/array_ops.cc
tensorflow/python/kernel_tests/array_ops/edit_distance_op_test.py
Commit message: Fix security vulnerability in EditDistance op shape function.

PiperOrigin-RevId: 504367470


Vulnerable code:

Fixed code:
#include "tensorflow/core/platform/status.h"
      if (hypothesis_shape_t->NumElements() < 2) {
        return errors::InvalidArgument(
            "Input Hypothesis SparseTensors must have rank at least 2, but "
            "hypothesis_shape rank is: ",
            hypothesis_shape_t->NumElements());
      }
      if (truth_shape_t->NumElements() < 2) {
        return errors::InvalidArgument(
            "Input Truth SparseTensors must have rank at least 2, but "
            "truth_shape rank is: ",
            truth_shape_t->NumElements());
      }
from tensorflow.python.eager import def_function
from tensorflow.python.framework import errors
  def testEmptyShapeWithEditDistanceRaisesError(self):
    para = {
        "hypothesis_indices": [[]],
        "hypothesis_values": ["tmp/"],
        "hypothesis_shape": [],
        "truth_indices": [[]],
        "truth_values": [""],
        "truth_shape": [],
        "normalize": False,
    }

    # Check edit distance raw op with empty shape in eager mode.
    with self.assertRaisesRegex(
        (errors.InvalidArgumentError, ValueError),
        (
            r"Input Hypothesis SparseTensors must have rank at least 2, but"
            " hypothesis_shape rank is: 0|Input SparseTensors must have rank "
            "at least 2, but truth_shape rank is: 0"
        ),
    ):
      array_ops.gen_array_ops.EditDistance(**para)

    # Check raw op with tf.function
    @def_function.function
    def TestFunction():
      """Wrapper function for edit distance call."""
      array_ops.gen_array_ops.EditDistance(**para)

    with self.assertRaisesRegex(
        ValueError,
        (
            "Input Hypothesis SparseTensors must have rank at least 2, but"
            " hypothesis_shape rank is: 0"
        ),
    ):
      TestFunction()

    # Check with python wrapper API
    hypothesis_indices = [[]]
    hypothesis_values = [0]
    hypothesis_shape = []
    truth_indices = [[]]
    truth_values = [1]
    truth_shape = []
    expected_output = []  # dummy ignored

    with self.assertRaisesRegex(
        ValueError,
        (
            "Input Hypothesis SparseTensors must have rank at least 2, but"
            " hypothesis_shape rank is: 0"
        ),
    ):
      self._testEditDistance(
          hypothesis=(hypothesis_indices, hypothesis_values, hypothesis_shape),
          truth=(truth_indices, truth_values, truth_shape),
          normalize=False,
          expected_output=expected_output,
      )