hitoshura25/cvefixes huggingface dataset:
CVE-2022-35983 (C++, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/util/tensor_slice_writer.cc
tensorflow/core/util/tensor_slice_writer.h
tensorflow/core/util/tensor_slice_writer_test.cc
Commit message: Fix tf.raw_ops.SaveSlices vulnerability with unsupported dtypes.

Check that given dtype is supported and emit a descriptive error if not.

PiperOrigin-RevId: 461660795


Vulnerable code:
      LOG(FATAL) << "MaxBytesPerElement not implemented for dtype: " << dt;
  return 0;
  size_t size_bound =
      ss->ByteSize() + kTensorProtoHeaderBytes +
      (MaxBytesPerElement(DataTypeToEnum<T>::value) * num_elements);
#include "tensorflow/core/lib/core/stringpiece.h"
#include "tensorflow/core/lib/io/path.h"
#include "tensorflow/core/lib/strings/str_util.h"

Fixed code:
  size_t max_bytes_per_element =
      TensorSliceWriter::MaxBytesPerElementOrZero(dt);
  if (max_bytes_per_element == 0) {
    LOG(FATAL) << "MaxBytesPerElement not implemented for dtype: " << dt;
  }
  return max_bytes_per_element;
}

/* static */
size_t TensorSliceWriter::MaxBytesPerElementOrZero(DataType dt) {
      return 0;
  static size_t MaxBytesPerElementOrZero(DataType dt);

  size_t max_bytes_per_element =
      MaxBytesPerElementOrZero(DataTypeToEnum<T>::value);
  if (max_bytes_per_element == 0) {
    return errors::InvalidArgument(
        "Tensor slice serialization not implemented for dtype ",
        DataTypeToEnum<T>::value);
  }
  size_t size_bound = ss->ByteSize() + kTensorProtoHeaderBytes +
                      (max_bytes_per_element * num_elements);
#include <algorithm>
#include <memory>
#include <vector>
#include "tensorflow/core/platform/path.h"
#include "tensorflow/core/protobuf/error_codes.pb.h"
TEST(TensorSliceWriterTest, InvalidInput) {
  SavedSlice ss;
  std::array<uint32_t, 1> data;
  std::fill(data.begin(), data.end(), 1234);
  Status s = TensorSliceWriter::SaveData(data.data(), data.size(), &ss);
  EXPECT_EQ(s.code(), error::INVALID_ARGUMENT);
  EXPECT_TRUE(absl::StrContains(
      s.error_message(),
      "Tensor slice serialization not implemented for dtype"));
}
CVE-2022-35984 (Python, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64` results in a mismatched type `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 72180be03447a10810edca700cbc9af690dfeb51. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/parameterized_truncated_normal_op.cc
tensorflow/python/kernel_tests/random/parameterized_truncated_normal_op_test.py
Commit message: Fix tensor shape dtype bug in parameterized_truncated_normal.

The original made the assumption that the dtype is int32 when it could
also be int64 - leading to a crash due to mismatched type.

PiperOrigin-RevId: 456685278


Vulnerable code:
    int32_t num_batches = shape_tensor.flat<int32>()(0);
    const int32_t num_dims = shape_tensor.dim_size(0);
      samples_per_batch *= shape_tensor.flat<int32>()(i);
    auto shape_vec = shape_tensor.flat<int32>();
    TensorShape tensor_shape;
    OP_REQUIRES_OK(ctx, TensorShapeUtils::MakeShape(
                            shape_vec.data(), shape_vec.size(), &tensor_shape));

Fixed code:
#include "tensorflow/core/framework/tensor_util.h"
    TensorShape tensor_shape;
    OP_REQUIRES_OK(ctx, tensor::MakeShape(shape_tensor, &tensor_shape));
    int32_t num_batches = tensor_shape.dim_size(0);
    const int32_t num_dims = tensor_shape.dims();
      samples_per_batch *= tensor_shape.dim_size(i);
  def testShapeTypes(self):
    for shape_dtype in [np.int32, np.int64]:
      shape = np.array([1000], dtype=shape_dtype)
      sample_op = random_ops.parameterized_truncated_normal(
          shape=shape, means=0.0, stddevs=0.1, minvals=-1., maxvals=1.)
      new_seed = random_ops.random_uniform([2],
                                           seed=1234,
                                           minval=0,
                                           maxval=(2**31 - 1),
                                           dtype=np.int32)
      sample_op_stateless = stateless.stateless_parameterized_truncated_normal(
          shape=shape,
          seed=new_seed,
          means=0.0,
          stddevs=0.1,
          minvals=-1.,
          maxvals=1.)

      samples = self.evaluate(sample_op)
      stateless_samples = self.evaluate(sample_op_stateless)
      self.assertAllEqual(samples.shape, shape)
      self.assertAllEqual(stateless_samples.shape, shape)
CVE-2022-35985 (Python, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/lrn_op.cc
tensorflow/python/kernel_tests/nn_ops/lrn_op_test.py
Commit message: Fix security vulnerability with LRNGradOp

PiperOrigin-RevId: 460738938


Vulnerable code:
            out_image.dim_size(2) == cols && out_image.dim_size(3) == depth,

Fixed code:
            out_image.dim_size(2) == cols && out_image.dim_size(3) == depth &&
            out_image.dims() == 4,
from tensorflow.python.framework import errors_impl
from tensorflow.python.ops import random_ops
  @test_util.run_in_graph_and_eager_modes
  def testIncompatibleInputAndOutputImageShapes(self):
    depth_radius = 1
    bias = 1.59018219
    alpha = 0.117728651
    beta = 0.404427052
    input_grads = random_ops.random_uniform(
        shape=[4, 4, 4, 4],
        minval=-10000,
        maxval=10000,
        dtype=dtypes.float32,
        seed=-2033)
    input_image = random_ops.random_uniform(
        shape=[4, 4, 4, 4],
        minval=-10000,
        maxval=10000,
        dtype=dtypes.float32,
        seed=-2033)
    invalid_output_image = random_ops.random_uniform(
        shape=[4, 4, 4, 4, 4, 4],
        minval=-10000,
        maxval=10000,
        dtype=dtypes.float32,
        seed=-2033)
    with self.assertRaises((ValueError, errors_impl.InvalidArgumentError)):
      self.evaluate(
          nn.lrn_grad(
              input_grads=input_grads,
              input_image=input_image,
              output_image=invalid_output_image,
              depth_radius=depth_radius,
              bias=bias,
              alpha=alpha,
              beta=beta))
CVE-2022-35986 (Python, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f4fa903593bc39b2f79530a74b8. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/bincount_op.cc
tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
Commit message: Fix RaggedBincount Segmentation Fault from the Splits arg

PiperOrigin-RevId: 461715364


Vulnerable code:

Fixed code:
    OP_REQUIRES(ctx, splits.size() > 0,
                errors::InvalidArgument("Splits must be non-empty"));

  @test_util.run_in_graph_and_eager_modes
  def test_splits_empty(self):  # b/238450914
    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                "Splits must be non-empty"):
      self.evaluate(
          gen_math_ops.ragged_bincount(
              splits=[],  # Invalid splits
              values=[1],
              size=1,
              weights=[1],
              binary_output=False,
              name=None))
CVE-2022-35987 (C++, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tensor `input` or to be length-0. A different `weights` shape will trigger a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf4c14353c2328636a18bfad1e151052c81d5f43. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/compiler/tf2xla/kernels/bincount_op.cc
tensorflow/core/kernels/bincount_op.cc
tensorflow/python/kernel_tests/math_ops/bincount_op_test.py
Commit message: Fix security vulnerability with DenseBincountOp

PiperOrigin-RevId: 460826735


Vulnerable code:

Fixed code:
    OP_REQUIRES(ctx,
                xla::ShapeUtil::CompatibleIgnoringElementType(weights_shape,
                                                              input_shape) ||
                    (weights_shape.dimensions_size() > 0 &&
                     weights_shape.dimensions(0) == 0),
                errors::InvalidArgument(
                    "`weights` must be the same shape as `arr` or a length-0 "
                    "`Tensor`, in which case it acts as all weights equal to "
                    "1. Received ",
                    weights_shape.DebugString()));

    OP_REQUIRES(ctx,
                weights.shape() == data.shape() || weights.NumElements() == 0,
                errors::InvalidArgument(
                    "`weights` must be the same shape as `arr` or a length-0 "
                    "`Tensor`, in which case it acts as all weights equal to "
                    "1. Received ",
                    weights.shape().DebugString()));

from tensorflow.python.ops import random_ops
  @test_util.run_in_graph_and_eager_modes
  def test_invalid_inputs(self):
    binary_output = True
    inp = random_ops.random_uniform(
        shape=[10, 10],
        minval=-10000,
        maxval=10000,
        dtype=dtypes.int32,
        seed=-2460)
    size = random_ops.random_uniform(
        shape=[], minval=-10000, maxval=10000, dtype=dtypes.int32, seed=-10000)
    weights = random_ops.random_uniform(
        shape=[],
        minval=-10000,
        maxval=10000,
        dtype=dtypes.float32,
        seed=-10000)
    with self.assertRaises(errors.InvalidArgumentError):
      self.evaluate(
          gen_math_ops.dense_bincount(
              input=inp,
              size=size,
              weights=weights,
              binary_output=binary_output))
CVE-2022-35988 (Python, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/linalg/svd_op_gpu.cu.cc
tensorflow/python/kernel_tests/linalg/svd_op_test.py
Commit message: Fix empty batch issue in svd.

If there are zero batches, the GPU kernel previously failed with a `work_element_count > 0`
check failure.  In the zero batch case, there is no output, so simply return.

PiperOrigin-RevId: 462210670


Vulnerable code:

Fixed code:
    // If there are zero batches, we are done.
    if (shapeRaw.num_elements() == 0) {
      done();
      return;
    }

  @test_util.run_in_graph_and_eager_modes(use_gpu=True)
  def testEmptyBatches(self):
    matrices = constant_op.constant(1.0, shape=[0, 2, 2])
    s, u, v = self.evaluate(linalg_ops.svd(matrices))
    self.assertAllEqual(s, np.zeros([0, 2]))
    self.assertAllEqual(u, np.zeros([0, 2, 2]))
    self.assertAllEqual(v, np.zeros([0, 2, 2]))
CVE-2022-35989 (Python, published 2022-09-16T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input tensor `input`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 32d7bd3defd134f21a4e344c8dfd40099aaf6b18. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/maxpooling_op.cc
tensorflow/python/kernel_tests/nn_ops/pooling_ops_test.py
Commit message: Fix MaxPool crash on GPU for invalid filter size.

If the filter size exceeds the input size by one for `VALID` padding,
return an empty tensor. This is consistent with XLA.

PiperOrigin-RevId: 462684864


Vulnerable code:

Fixed code:
    // Degenerate pooling output should return an empty tensor.
    if (out_shape.num_elements() == 0) {
      Tensor* output = nullptr;
      OP_REQUIRES_OK(context, context->allocate_output(0, out_shape, &output));
      return;
    }

  @parameterized.parameters(
      GetTestConfigsDicts(nn_ops.max_pool, gen_nn_ops.max_pool_v2))
  @test_util.run_deprecated_v1
  def testMaxPoolInvalidFilterSize(self, **kwargs):
    with self.cached_session(use_gpu=test.is_gpu_available()):
      t = constant_op.constant(1.0, shape=[1, 1, 1, 1])
      with self.assertRaisesRegex(
          (errors_impl.InvalidArgumentError, ValueError),
          "Negative dimension size"):
        t = self.evaluate(
            nn_ops.max_pool(t, ksize=[1, 1, 2, 1], strides=1, padding="VALID"))
CVE-2022-35991 (Python, published 2022-09-16T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element_shape` of a rank greater than one, they give a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit bb03fdf4aae944ab2e4b35c7daa051068a8b7f61. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/list_kernels.h
tensorflow/python/kernel_tests/data_structures/list_ops_test.py
Commit message: Check for element_shape in TensorListScatter and TensorListScatterV2

PiperOrigin-RevId: 462460346


Vulnerable code:

Fixed code:
    OP_REQUIRES(
        c, !TensorShapeUtils::IsMatrixOrHigher(c->input(2).shape()),
        errors::InvalidArgument(
            "TensorListScatter: element_shape must be at most rank 1 but has ",
            "the shape of ", c->input(2).shape().DebugString()));
  def testScatterFailsWhenElementShapeIsNotVector(self):
    c0 = constant_op.constant([1.0, 2.0])
    # In Eager mode, InvalidArgumentError is generated by the Compute function.
    # In graph mode, ValueError is generated by the shape function.
    with self.assertRaisesRegex(
        (errors.InvalidArgumentError, ValueError),
        "must be at most rank 1"):
      l = gen_list_ops.tensor_list_scatter(
          # Wrong element_shape. Should be at most rank 1.
          c0, [1, 3], element_shape=[[1]])
      self.evaluate(l)

  def testScatterV2FailsWhenElementShapeIsNotVector(self):
    c0 = constant_op.constant([1.0, 2.0])
    # In Eager mode, InvalidArgumentError is generated by the Compute function.
    # In graph mode, ValueError is generated by the shape function.
    with self.assertRaisesRegex(
        (errors.InvalidArgumentError, ValueError),
        "must be at most rank 1"):
      l = gen_list_ops.tensor_list_scatter_v2(
          # Wrong element_shape. Should be at most rank 1.
          c0, [1, 3], element_shape=[[1]], num_elements=2)
      self.evaluate(l)
CVE-2022-35992 (Python, published 2022-09-16T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/list_kernels.h
tensorflow/python/kernel_tests/data_structures/list_ops_test.py
Commit message: Check for element_shape in TensorListFromTensor

PiperOrigin-RevId: 462468167


Vulnerable code:

Fixed code:
    OP_REQUIRES(
        c, !TensorShapeUtils::IsMatrixOrHigher(c->input(1).shape()),
        errors::InvalidArgument(
            "TensorListFromTensor: element_shape must be at most rank 1 but ",
            "has the shape of ", c->input(1).shape().DebugString()));
  def testTensorListFromTensorFailsWhenElementShapeIsNotVector(self):
    t = constant_op.constant([1.0, 2.0])
    # In Eager mode, InvalidArgumentError is generated by the Compute function.
    # In graph mode, ValueError is generated by the shape function.
    with self.assertRaisesRegex(
        (errors.InvalidArgumentError, ValueError),
        "must be at most rank 1"):
      # Wrong element_shape. Should be at most rank 1.
      l = list_ops.tensor_list_from_tensor(t, element_shape=[[1]])
      self.evaluate(l)
CVE-2022-35993 (Python, published 2022-09-16T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/set_kernels.cc
tensorflow/python/kernel_tests/math_ops/sets_test.py
Commit message: Fix tf.raw_ops.SetSize vulnerability with invalid input arg specifying shape.

Check that given input is a 1D tensor, as required.

PiperOrigin-RevId: 460740463


Vulnerable code:
  TF_RETURN_IF_ERROR(TensorShape::BuildTensorShape(
      ctx->input(base_index + 2).vec<int64_t>(), &shape));

Fixed code:
  const Tensor& shape_tensor = ctx->input(base_index + 2);
  if (shape_tensor.dims() != 1) {
    return errors::InvalidArgument("Shape must be a 1D tensor.");
  }
  TF_RETURN_IF_ERROR(
      TensorShape::BuildTensorShape(shape_tensor.vec<int64_t>(), &shape));
from tensorflow.python.ops import gen_set_ops
  def test_raw_ops_setsize_invalid_shape(self):
    with self.assertRaisesRegex(errors_impl.InvalidArgumentError,
                                "Shape must be a 1D tensor"):
      invalid_shape = 1
      self.evaluate(
          gen_set_ops.set_size(
              set_indices=1,
              set_values=[1, 1],
              set_shape=invalid_shape,
              validate_indices=True,
              name=""))