hitoshura25/cvefixes huggingface dataset:
CVE-2021-41206 (C, published 2021-11-05T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-354 \u2014 Improper Validation of Integrity Check Value
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/pooling_ops_common.h
Commit message: Fix segfault in pools on empty shapes when certain dimension were very large.

Pooling ops multiply certain components of the input shape, e.g. by multiplying input.shape[1] * input.shape[2] * input.shape[3]. This multiplication could overflow an int64 value if shape[0] was 0 but shape[1], shape[2], and shape[3] were very large, e.g. by passing an input with shape (0, 2**25, 2**25, 2**25).

PiperOrigin-RevId: 404644978
Change-Id: Ic79f89c970357ca2962b1f231449066db9403146


Vulnerable code:

Fixed code:
    if (output->NumElements() == 0) {
      return;
    }
    if (output->NumElements() == 0) {
      return;
    }
  if (output->NumElements() == 0) {
    return;
  }
CVE-2021-41207 (Python, published 2021-11-05T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/inplace_ops.cc
tensorflow/python/kernel_tests/array_ops/stack_op_test.py
Commit message: Adding more validation checks to _ParallelConcatUpdate to avoid NPE.

PiperOrigin-RevId: 402569467
Change-Id: I2db122dab68be2a5e4e8dd3375f5a70c4d2307ec


Vulnerable code:

Fixed code:
    // Value should be at least rank 1. Also the 0th dimension should be
    // at least loc_.
    OP_REQUIRES(ctx, value.dims() >= 1,
                errors::InvalidArgument("value should be at least rank 1."));
    OP_REQUIRES(
        ctx, value.dim_size(0) > loc_,
        errors::InvalidArgument("0th dimension of value = ", value.dim_size(0),
                                " is less than loc_=", loc_));

from tensorflow.python import tf2
from tensorflow.python.eager import def_function
from tensorflow.python.framework import errors
from tensorflow.python.ops import gen_array_ops
  def testParallelConcatShapeZero(self):
    if not tf2.enabled():
      self.skipTest("only fails in TF2")

    @def_function.function
    def f():
      y = gen_array_ops.parallel_concat(values=[["tf"]], shape=0)
      return y

    with self.assertRaisesRegex(errors.InvalidArgumentError,
                                r"0th dimension of value .* is less than"):
      f()
CVE-2021-41209 (Python, published 2021-11-05T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/inplace_ops.cc
tensorflow/python/kernel_tests/array_ops/stack_op_test.py
Commit message: Adding more validation checks to _ParallelConcatUpdate to avoid NPE.

PiperOrigin-RevId: 402569467
Change-Id: I2db122dab68be2a5e4e8dd3375f5a70c4d2307ec


Vulnerable code:

Fixed code:
    // Value should be at least rank 1. Also the 0th dimension should be
    // at least loc_.
    OP_REQUIRES(ctx, value.dims() >= 1,
                errors::InvalidArgument("value should be at least rank 1."));
    OP_REQUIRES(
        ctx, value.dim_size(0) > loc_,
        errors::InvalidArgument("0th dimension of value = ", value.dim_size(0),
                                " is less than loc_=", loc_));

from tensorflow.python import tf2
from tensorflow.python.eager import def_function
from tensorflow.python.framework import errors
from tensorflow.python.ops import gen_array_ops
  def testParallelConcatShapeZero(self):
    if not tf2.enabled():
      self.skipTest("only fails in TF2")

    @def_function.function
    def f():
      y = gen_array_ops.parallel_concat(values=[["tf"]], shape=0)
      return y

    with self.assertRaisesRegex(errors.InvalidArgumentError,
                                r"0th dimension of value .* is less than"):
      f()
CVE-2021-41210 (Python, published 2021-11-05T20:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/count_ops.cc
tensorflow/python/ops/bincount_ops_test.py
Commit message: Fix heap out of bounds error in tf.raw_ops.SparseCountSparseOutput shape inference when it is called with invalid inputs, and add a test for it.

PiperOrigin-RevId: 405766415
Change-Id: I77d244ef35f351ef7b6f821efd959cac2c66db24


Vulnerable code:

Fixed code:
  ShapeHandle unused;
  TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &unused));
class RawOpsHeapOobTest(test.TestCase, parameterized.TestCase):

  @test_util.run_v1_only("Test security error")
  def testSparseCountSparseOutputBadIndicesShapeTooSmall(self):
    indices = [1]
    values = [[1]]
    weights = []
    dense_shape = [10]
    with self.assertRaisesRegex(ValueError,
                                "Shape must be rank 2 but is rank 1 for"):
      self.evaluate(
          gen_count_ops.SparseCountSparseOutput(
              indices=indices,
              values=values,
              dense_shape=dense_shape,
              weights=weights,
              binary_output=True))
CVE-2021-41211 (C++, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/framework/common_shape_fns.cc
Commit message: Prevent OOB access in QuantizeV2 shape inference

PiperOrigin-RevId: 400309614
Change-Id: I31412c71b05b4f21b677f7fa715a61499cbee39d


Vulnerable code:

Fixed code:
  if (axis < -1) {
    return errors::InvalidArgument("axis should be at least -1, got ", axis);
  }
CVE-2021-41212 (Python, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/ragged_array_ops.cc
tensorflow/python/ops/ragged/ragged_cross_op_test.py
Commit message: Fix null pointer exception in shape inference function when tf.ragged.cross() is called with invalid inputs.

PiperOrigin-RevId: 400045848
Change-Id: Ia65501583b85cf1ec14a252d83fbdd716817a516


Vulnerable code:
                       message=None):
      self.evaluate(ragged_array_ops.cross(inputs))

Fixed code:
        int32 rank = c->Rank(dense_input);
        if (rank == InferenceContext::kUnknownRank) {
          continue;
        } else if (rank != 2) {
          return errors::InvalidArgument(
              "tf.ragged.cross only supports inputs with rank=2");
        }
from tensorflow.python.eager import def_function
from tensorflow.python.framework import tensor_spec
      dict(
          testcase_name='3DDenseTensor',
          inputs=[dense_const([[[1]]])],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='0DDenseTensor',
          inputs=[dense_const(1)],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='0DDenseTensor',
          inputs=[dense_const(1)],
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='1DDenseTensor',
          inputs=[dense_const([1])],
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
                       message=None,
                       signature=None):
    @def_function.function(input_signature=signature)
    def fn(x):
      return ragged_array_ops.cross(x)

      self.evaluate(fn(inputs))
CVE-2021-41214 (Python, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/ragged_array_ops.cc
tensorflow/python/ops/ragged/ragged_cross_op_test.py
Commit message: Fix null pointer exception in shape inference function when tf.ragged.cross() is called with invalid inputs.

PiperOrigin-RevId: 400045848
Change-Id: Ia65501583b85cf1ec14a252d83fbdd716817a516


Vulnerable code:
                       message=None):
      self.evaluate(ragged_array_ops.cross(inputs))

Fixed code:
        int32 rank = c->Rank(dense_input);
        if (rank == InferenceContext::kUnknownRank) {
          continue;
        } else if (rank != 2) {
          return errors::InvalidArgument(
              "tf.ragged.cross only supports inputs with rank=2");
        }
from tensorflow.python.eager import def_function
from tensorflow.python.framework import tensor_spec
      dict(
          testcase_name='3DDenseTensor',
          inputs=[dense_const([[[1]]])],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='0DDenseTensor',
          inputs=[dense_const(1)],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='0DDenseTensor',
          inputs=[dense_const(1)],
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
      dict(
          testcase_name='1DDenseTensor',
          inputs=[dense_const([1])],
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
          message='tf.ragged.cross only supports inputs with rank=2'),
          signature=[[tensor_spec.TensorSpec(None, dtypes.int32)]],
          exception=(ValueError, errors.InvalidArgumentError),
                       message=None,
                       signature=None):
    @def_function.function(input_signature=signature)
    def fn(x):
      return ragged_array_ops.cross(x)

      self.evaluate(fn(inputs))
CVE-2021-41215 (Python, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/sparse_ops.cc
tensorflow/python/kernel_tests/sparse_serialization_ops_test.py
Commit message: Ensuring that the input to DeserializeSparse is not a scalar.

PiperOrigin-RevId: 400554784
Change-Id: Ib658701040d4f707f20b8706e251d5fff46b2671


Vulnerable code:

Fixed code:
#include "tensorflow/core/framework/types.pb.h"
      ShapeHandle unused_shape;
      TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(0), 1, &unused_shape));
from tensorflow.python.eager import def_function
from tensorflow.python.ops import gen_resource_variable_ops
  def testDeserializeInvalidVariant(self):
    mu = gen_resource_variable_ops.mutex_v2()
    mu_lock = gen_resource_variable_ops.mutex_lock(mutex=mu)

    @def_function.function
    def f():
      return sparse_ops.deserialize_sparse(
          serialized_sparse=mu_lock, dtype=dtypes.int32)

    with self.assertRaisesRegex(ValueError, r"Shape must be at least rank 1"):
      f()
CVE-2021-41216 (C++, published 2021-11-05T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/ops/array_ops.cc
Commit message: Make Transpose's shape inference function validate that negative `perm` values are within the tensor's rank.

PiperOrigin-RevId: 403252853
Change-Id: Ia6b31b45b237312668bb31c2c3b3c7bbce2d2610


Vulnerable code:
      if (in_idx >= rank) {

Fixed code:
      if (in_idx >= rank || in_idx <= -rank) {
CVE-2021-41217 (C++, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/common_runtime/immutable_executor_state.cc
Commit message: Fix a NPE issue in invalid Exit op. Now it will report an error instead of crash.

PiperOrigin-RevId: 404089902
Change-Id: Ia6ec55445ea70ad045a4d339d354959ad0618f2a


Vulnerable code:

Fixed code:
      if (!parent) {
        return errors::InvalidArgument(
            "Invalid Exit op: Cannot find a corresponding Enter op.");
      }
CVE-2021-41219 (C++, published 2021-11-05T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/sparse_matmul_op.cc
Commit message: Validate that matrix dimension sizes in SparseMatMul are positive.

PiperOrigin-RevId: 401149683
Change-Id: Ib33eafc561a39c8741ece80b2edce6d4aae9a57d


Vulnerable code:

Fixed code:
#include "tensorflow/core/platform/errors.h"
    OP_REQUIRES(ctx, m >= 0 && n >= 0 && k >= 0,
                errors::InvalidArgument(
                    "Matrix dimensions cannot be negative: a: ",
                    a.shape().DebugString(), ", b: ", b.shape().DebugString()));
    // Return early if at least one of the output dimension size is 0.
    if (m == 0 || n == 0) {
      return;
    }
CVE-2021-41222 (C++, published 2021-11-05T23:15Z)
Description: value: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/split_v_op.cc
tensorflow/core/ops/array_ops.cc
tensorflow/python/kernel_tests/split_op_test.py
Commit message: A negative size in one of the split sizes allowed the computed size of another
to exceed the total dimension, leading to a segfault and security vulnerability.
Adding a check for negative sizes prevents this.

PiperOrigin-RevId: 401035665
Change-Id: I79bbe329787dac82aa4bf60397a9129b716aedab


Vulnerable code:

Fixed code:
    for (int i = 0; i < split_sizes_vec->size(); ++i) {
      const Tlen& split_size = (*split_sizes_vec)[i];
      OP_REQUIRES(context, split_size >= Tlen(0),
                  errors::InvalidArgument("Split size at index ", i,
                                          " must be >= 0. Got: ", split_size));
    }

          // If we have a negative known size (either explicit, or computed
          // via -1), then the split sizes are invalid.
          if (size < -1 || (size == -1 && c->ValueKnown(split_dim_size))) {
            return errors::InvalidArgument("Split size at index ", i,
                                           " must be >= 0. Got: ", size);
          }
  @test_util.run_in_graph_and_eager_modes
  def testNegativeSizes(self):
    x = constant_op.constant([1, 2, 3], dtypes.float32)
    # A size of -1 signifies to determine size based on sum of other splits.
    with self.assertRaisesRegex((ValueError, errors_impl.InvalidArgumentError),
                                "Split size at index 1 must be >= 0. Got: -2"):
      splits = [-1, -2]
      self.evaluate(array_ops.split(x, splits, axis=0))

  @test_util.run_in_graph_and_eager_modes
  def testBadSplitSizes(self):
    x = constant_op.constant([1, 2], dtypes.float32)
    with self.assertRaisesRegex((ValueError, errors_impl.InvalidArgumentError),
                                "Determined shape must either match input"
                                "|can't split axis"):
      splits = [1, 2]
      self.evaluate(array_ops.split(x, splits, axis=0))