hitoshura25/cvefixes huggingface dataset:
CVE-2022-23595 (C++, published 2022-02-04T23:15Z)
Description: value: Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference. In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/compiler/jit/xla_platform_info.cc
Commit message: Fix Null-pointer dereference in BuildXlaCompilationCache

If ConfigProto is not used, then use the default settings which is to allow all devices.

PiperOrigin-RevId: 420391800
Change-Id: I88161ad7042990aef678e77b597a2fb2c8f815be


Vulnerable code:
  string allowed_gpus =
      flr->config_proto()->gpu_options().visible_device_list();
  TF_ASSIGN_OR_RETURN(absl::optional<std::set<int>> gpu_ids,
                      ParseVisibleDeviceList(allowed_gpus));
  client_options.set_allowed_devices(gpu_ids);

Fixed code:
  if (flr->config_proto()) {
    string allowed_gpus =
        flr->config_proto()->gpu_options().visible_device_list();
    TF_ASSIGN_OR_RETURN(absl::optional<std::set<int>> gpu_ids,
                        ParseVisibleDeviceList(allowed_gpus));
    client_options.set_allowed_devices(gpu_ids);
  }
CVE-2022-29191 (C++, published 2022-05-20T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/session_ops.cc
Commit message: Fix tf.raw_ops.GetSessionTensor vulnerability with invalid handle.

Check that input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445218701


Vulnerable code:

Fixed code:
    OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),
                errors::InvalidArgument("handle must be scalar"));
CVE-2022-29192 (C++, published 2022-05-20T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/quantize_and_dequantize_op.cc
Commit message: Fix tf.raw_ops.QuantizeAndDequantizeV4Grad vulnerability with invalid input_min or input_max.

Check that argument is actually a scalar before treating it as such.

PiperOrigin-RevId: 445198280


Vulnerable code:
                    "Input min tensor must have dimension 1. Recieved ",
                    "Input max tensor must have dimension 1. Recieved ",

Fixed code:
                    "Input min tensor must have dimension 0 or 1. Received ",
                    "Input max tensor must have dimension 0 or 1. Received ",
      OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(input_min_tensor.shape()),
                  errors::InvalidArgument(
                      "input_min must be a scalar if axis is unspecified"));
      OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(input_max_tensor.shape()),
                  errors::InvalidArgument(
                      "input_max must be a scalar if axis is unspecified"));
CVE-2022-29193 (C++, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/summary_tensor_op.cc
Commit message: Fix tf.raw_ops.TensorSummaryV2 vulnerability with invalid serialized_summary_metadata.

Check that input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445197183


Vulnerable code:

Fixed code:
    OP_REQUIRES(
        c,
        TensorShapeUtils::IsScalar(serialized_summary_metadata_tensor.shape()),
        errors::InvalidArgument("serialized_summary_metadata must be scalar"));
CVE-2022-29194 (C++, published 2022-05-20T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/session_ops.cc
Commit message: Fix tf.raw_ops.DeleteSessionTensor vulnerability with invalid `handle`.

Check that `handle` input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445228994


Vulnerable code:

Fixed code:
    OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),
                errors::InvalidArgument("`handle` must be scalar"));
CVE-2022-29195 (Python, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/stage_op.cc
tensorflow/python/kernel_tests/data_structures/stage_op_test.py
tensorflow/python/ops/data_flow_ops.py
Commit message: Fix tf.raw_ops.StagePeek vulnerability with invalid `index`.

Check that input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445524908


Vulnerable code:
      raise ValueError(f"Unexpected number of inputs {len(vals)} vs"

Fixed code:
    OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(ctx->input(0).shape()),
                errors::InvalidArgument("index must be scalar"));
from tensorflow.python.framework import errors
  def testPeekBadIndex(self):
    stager = data_flow_ops.StagingArea([
        dtypes.int32,
    ], shapes=[[10]])
    stager.put([array_ops.zeros([10], dtype=dtypes.int32)])

    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                'must be scalar'):
      self.evaluate(stager.peek([]))

      raise ValueError(f"Unexpected number of inputs {len(vals)} vs "
CVE-2022-29196 (Python, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/conv_grad_ops_3d.cc
tensorflow/python/kernel_tests/nn_ops/conv3d_backprop_filter_v2_grad_test.py
Commit message: Fix failed check in Conv3DBackpropFilterV2.

Passing in a rank-0 `filter_size` causes a check fail and crash,
coming from a `filter_size.vec<>()` call.  Here we check the size
first.

PiperOrigin-RevId: 445517122


Vulnerable code:

Fixed code:
      OP_REQUIRES(context, TensorShapeUtils::IsVector(filter_sizes.shape()),
                  errors::InvalidArgument(
                      "filter_sizes shape must be rank 1 but is rank ",
                      filter_sizes.shape().dims()));
      OP_REQUIRES(context, TensorShapeUtils::IsVector(filter_sizes.shape()),
                  errors::InvalidArgument(
                      "filter_sizes shape must be rank 1 but is rank ",
                      filter_sizes.shape().dims()));
      OP_REQUIRES(context, TensorShapeUtils::IsVector(filter_sizes.shape()),
                  errors::InvalidArgument(
                      "filter_sizes shape must be rank 1 but is rank ",
                      filter_sizes.shape().dims()));
from tensorflow.python.framework import errors
  def testBadFilterShape(self):
    strides = [1, 1, 1, 1, 1]
    padding = "VALID"
    tin = constant_op.constant(
        .5053710941, shape=[2, 2, 2, 2, 1], dtype=dtypes.float32)
    filter_sizes = constant_op.constant(0, shape=[], dtype=dtypes.int32)
    out_backprop = constant_op.constant(
        .5053710941, shape=[2, 2, 2, 2, 1], dtype=dtypes.float32)

    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                "must be rank 1"):
      nn_ops.conv3d_backprop_filter_v2(
          input=tin,
          filter_sizes=filter_sizes,
          out_backprop=out_backprop,
          strides=strides,
          padding=padding)
CVE-2022-29197 (C++, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/unsorted_segment_join_op.cc
Commit message: Fix tf.raw_ops.UnsortedSegmentJoin vulnerability with invalid num_segments.

Check that input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445206880


Vulnerable code:

Fixed code:
    OP_REQUIRES(context,
                TensorShapeUtils::IsScalar(num_segments_tensor.shape()),
                errors::InvalidArgument("Number of segments must be a scalar"));
CVE-2022-29198 (Python, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/sparse/sparse_tensor_to_csr_sparse_matrix_op.cc
tensorflow/python/kernel_tests/linalg/sparse/csr_sparse_matrix_ops_test.py
Commit message: Fix failed check in SparseTensorToCSRSparseMatrix

Security vulnerability fix. A `CHECK` fails if inputing either an empty `dense_shape`,
or a non-rank-2 `indices`. Added appropriate checks and tests.

PiperOrigin-RevId: 446053984


Vulnerable code:

Fixed code:
    OP_REQUIRES(
        ctx, TensorShapeUtils::IsVector(dense_shape.shape()),
        errors::InvalidArgument("dense_shape must be rank 1 but got rank",
                                dense_shape.shape().dims()));
    OP_REQUIRES(ctx, TensorShapeUtils::IsMatrix(indices.shape()),
                errors::InvalidArgument("indices must be rank 2 but got rank",
                                        indices.shape().dims()));
  def testSparseTensorConversionInvalidInputShapes(self):
    values = constant_op.constant(
        0.554979503, shape=[5], dtype=dtypes.float32)
    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                "must be rank 1"):
      indices = constant_op.constant(0, shape=[5, 2], dtype=dtypes.int64)
      dense_shape = constant_op.constant(53, shape=[], dtype=dtypes.int64)
      csr = sparse_csr_matrix_ops.sparse_tensor_to_csr_sparse_matrix(
          indices=indices, values=values, dense_shape=dense_shape)
      self.evaluate(csr)

    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
                                "must be rank 2"):
      indices = constant_op.constant(0, shape=[5], dtype=dtypes.int64)
      dense_shape = constant_op.constant(53, shape=[1], dtype=dtypes.int64)
      csr = sparse_csr_matrix_ops.sparse_tensor_to_csr_sparse_matrix(
          indices=indices, values=values, dense_shape=dense_shape)
      self.evaluate(csr)
CVE-2022-29199 (Python, published 2022-05-20T22:16Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/load_and_remap_matrix_op.cc
tensorflow/python/kernel_tests/io_ops/checkpoint_ops_test.py
Commit message: Fix tf.raw_ops.LoadAndRemapMatrix vulnerability with invalid `row_remapping`.

Check that `row_remapping` has the correct dims().

PiperOrigin-RevId: 445522800


Vulnerable code:

Fixed code:
    OP_REQUIRES(
        context, row_remapping_t->dims() == 1,
        errors::InvalidArgument("The `row_remapping` tensor must be 1-D, got "
                                "a tensor of shape ",
                                row_remapping_t->shape().DebugString()));
  def test_load_and_remap_invalid_dims(self):
    ckpt_path = constant_op.constant(
        '/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0',
        shape=[],
        dtype=dtypes.string)
    old_tensor_name = constant_op.constant(
        '/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0',
        shape=[],
        dtype=dtypes.string)
    row_remapping = constant_op.constant(0, shape=[], dtype=dtypes.int64)
    col_remapping = constant_op.constant(3, shape=[3], dtype=dtypes.int64)
    initializing_values = constant_op.constant([],
                                               shape=[0, 1],
                                               dtype=dtypes.float32)
    with self.cached_session(), self.assertRaisesRegex(
        (ValueError, errors.InvalidArgumentError), 'tensor must be 1-D'):
      self.evaluate(
          gen_checkpoint_ops.load_and_remap_matrix(
              ckpt_path=ckpt_path,
              old_tensor_name=old_tensor_name,
              row_remapping=row_remapping,
              col_remapping=col_remapping,
              initializing_values=initializing_values,
              num_rows=1,
              num_cols=1))
CVE-2022-29202 (Python, published 2022-05-20T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/python/ops/ragged/ragged_factory_ops.py
Commit message: Prevent denial of service in `tf.ragged.constant`

Fixes #55199

PiperOrigin-RevId: 442029525


Vulnerable code:

Fixed code:
    if ragged_rank is not None and max_depth < ragged_rank:
      raise ValueError(f"Invalid pylist={pylist}, max depth smaller than "
                       f"ragged_rank={ragged_rank}")
CVE-2022-29204 (C++, published 2022-05-20T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/unsorted_segment_join_op.cc
Commit message: Allow 0 for number of segments in `unsorted_segment_join_op.cc`

Related to the fix for #55305

PiperOrigin-RevId: 443157549


Vulnerable code:
    OP_REQUIRES(context, num_segments > 0,
                errors::InvalidArgument("Number of segments must be positive"));

Fixed code:
    OP_REQUIRES(
        context, num_segments >= 0,
        errors::InvalidArgument(
            "Number of segments must be non-negative but got ", num_segments));
CVE-2022-29204 (C++, published 2022-05-20T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/unsorted_segment_join_op.cc
Commit message: Validate `num_segments > 0` in `unsorted_segment_join`

Fixes #55305

PiperOrigin-RevId: 442047005


Vulnerable code:

Fixed code:
    OP_REQUIRES(context, num_segments > 0,
                errors::InvalidArgument("Number of segments must be positive"));