CVE-2022-35973 (C++, published 2022-09-16T21:15Z)
Description: value: TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit aca766ac7693bf29ed0df55ad6bfcc78f35e7f48. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/quantized_matmul_op.cc
tensorflow/core/kernels/quantized_matmul_op_test.cc
Commit message: Fix tf.raw_ops. QuantizedMatMul vulnerability from non scalar min/max a/b arguments.

PiperOrigin-RevId: 465364257


Vulnerable code:
  AddInputFromArray<float>(TensorShape({1}), {0});
  AddInputFromArray<float>(TensorShape({1}), {255.0f});
  AddInputFromArray<float>(TensorShape({1}), {0});
  AddInputFromArray<float>(TensorShape({1}), {255.0f});
  AddInputFromArray<float>(TensorShape({1}), {-12.0f});
  AddInputFromArray<float>(TensorShape({1}), {243.0f});
  AddInputFromArray<float>(TensorShape({1}), {1.0f});
  AddInputFromArray<float>(TensorShape({1}), {256.0f});
  AddInputFromArray<float>(TensorShape({1}), {-12.0f});
  AddInputFromArray<float>(TensorShape({1}), {243.0f});
  AddInputFromArray<float>(TensorShape({1}), {1.0f});
  AddInputFromArray<float>(TensorShape({1}), {1.0f});
  AddInputFromArray<float>(TensorShape({1}), {-12.0f});
  AddInputFromArray<float>(TensorShape({1}), {243.0f});
  AddInputFromArray<float>(TensorShape({1}), {0});
  AddInputFromArray<float>(TensorShape({1}), {255.0f});
  AddInputFromArray<float>(TensorShape({1}), {a_min});
  AddInputFromArray<float>(TensorShape({1}), {a_max});
  AddInputFromArray<float>(TensorShape({1}), {b_min});
  AddInputFromArray<float>(TensorShape({1}), {b_max});

Fixed code:
#include "tensorflow/core/framework/op_requires.h"
#include "tensorflow/core/framework/tensor_shape.h"
#include "tensorflow/core/platform/errors.h"
    OP_REQUIRES(context, TensorShapeUtils::IsScalar(context->input(2).shape()),
                errors::InvalidArgument("min_a must be a scalar, but got shape",
                                        context->input(2).shape()));
    OP_REQUIRES(context, context->input(3).NumElements() == 1,
                errors::InvalidArgument("max_a must be a scalar, but got shape",
                                        context->input(3).shape()));
    OP_REQUIRES(context, context->input(4).NumElements() == 1,
                errors::InvalidArgument("min_b must be a scalar, but got shape",
                                        context->input(4).shape()));
    OP_REQUIRES(context, context->input(5).NumElements() == 1,
                errors::InvalidArgument("max_b must be a scalar, but got shape",
                                        context->input(5).shape()));
  AddInputFromArray<float>(TensorShape({}), {0});
  AddInputFromArray<float>(TensorShape({}), {255.0f});
  AddInputFromArray<float>(TensorShape({}), {0});
  AddInputFromArray<float>(TensorShape({}), {255.0f});
  AddInputFromArray<float>(TensorShape({}), {-12.0f});
  AddInputFromArray<float>(TensorShape({}), {243.0f});
  AddInputFromArray<float>(TensorShape({}), {1.0f});
  AddInputFromArray<float>(TensorShape({}), {256.0f});
  AddInputFromArray<float>(TensorShape({}), {-12.0f});
  AddInputFromArray<float>(TensorShape({}), {243.0f});
  AddInputFromArray<float>(TensorShape({}), {1.0f});
  AddInputFromArray<float>(TensorShape({}), {1.0f});
  EXPECT_EQ(::tensorflow::error::INVALID_ARGUMENT, RunOpKernel().code());
}

// This test multiplies two 1x1 8bit matrices, but sets invalid quantized min
// and max values, so we expect to get an error
TEST_F(QuantizedMatMulTest, VerySmall_BadMinMax) {
  // These parameters reflect a typical production usage of eight-bit matmuls
  // in an Inception-style network.
  const bool transpose_a = true;
  const int a_rows = 1;
  const int a_cols = 1;
  const int b_rows = 1;
  const int b_cols = 1;
  const bool transpose_b = false;
  TF_ASSERT_OK(NodeDefBuilder("quantized_mat_mul_op", "QuantizedMatMul")
                   .Input(FakeInput(DT_QUINT8))
                   .Input(FakeInput(DT_QUINT8))
                   .Input(FakeInput(DT_FLOAT))
                   .Input(FakeInput(DT_FLOAT))
                   .Input(FakeInput(DT_FLOAT))
                   .Input(FakeInput(DT_FLOAT))
                   .Attr("Toutput", DataTypeToEnum<qint32>::v())
                   .Attr("transpose_a", transpose_a)
                   .Attr("transpose_b", transpose_b)
                   .Finalize(node_def()));
  TF_ASSERT_OK(InitOp());
  // The A matrix is:
  // |  -1 |
  AddInputFromArray<quint8>(TensorShape({a_rows, a_cols}), {11});
  // The B matrix is:
  // |   1 |
  AddInputFromArray<quint8>(TensorShape({b_rows, b_cols}), {0});
  // Here we set the error of a non scalar min_a value, so we expect to see an
  // error when we run.
  AddInputFromArray<float>(TensorShape({1}), {2});
  AddInputFromArray<float>(TensorShape({}), {243.0f});
  AddInputFromArray<float>(TensorShape({}), {1.0f});
  AddInputFromArray<float>(TensorShape({}), {256.0f});
  AddInputFromArray<float>(TensorShape({}), {-12.0f});
  AddInputFromArray<float>(TensorShape({}), {243.0f});
  AddInputFromArray<float>(TensorShape({}), {0});
  AddInputFromArray<float>(TensorShape({}), {255.0f});
  AddInputFromArray<float>(TensorShape({}), {a_min});
  AddInputFromArray<float>(TensorShape({}), {a_max});
  AddInputFromArray<float>(TensorShape({}), {b_min});
  AddInputFromArray<float>(TensorShape({}), {b_max});