hitoshura25/cvefixes huggingface dataset:
CVE-2022-41899 (C++, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/sdca_internal.cc
tensorflow/core/kernels/sdca_ops.cc
Commit message: Fix SDCA optimizer crash.

Validates size of the dense_features and example state_data_inputs.
Other validation already verifies that sizes are otherwise consistent.

This looks to be a v1-only op that isn't used internally at all outside
of `contrib`, and no tests.

PiperOrigin-RevId: 478073762


Vulnerable code:

Fixed code:
  for (int i = 0; i < dense_features_inputs.size(); ++i) {
    if (!TensorShapeUtils::IsMatrix(dense_features_inputs[i].shape())) {
      return errors::InvalidArgument("Dense features at index ", i,
                                     " must be rank 2 but is rank ",
                                     dense_features_inputs[i].dims());
    }
  }
#include "tensorflow/core/platform/errors.h"
  OP_REQUIRES(
      context, TensorShapeUtils::IsMatrix(example_state_data_t->shape()),
      errors::InvalidArgument("example_state_data must be rank 2 but is rank ",
                              example_state_data_t->dims()));
CVE-2022-41901 (Python, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in `tf.raw_ops.SparseMatrixNNZ`. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/sparse/sparse_matrix.h
tensorflow/python/kernel_tests/linalg/sparse/csr_sparse_matrix_ops_test.py
Commit message: Fix missing sparse matrix crash.

Calling a sparse matrix op with no matrix currently causes a crash.  Here we check and
return a non-ok status.

PiperOrigin-RevId: 476379116


Vulnerable code:

Fixed code:
#include "tensorflow/core/framework/tensor_shape.h"
#include "tensorflow/core/platform/errors.h"
  if (!TensorShapeUtils::IsScalar(input_t.shape())) {
    return errors::InvalidArgument(
        "Invalid input matrix: Shape must be rank 0 but is rank ",
        input_t.dims());
  }
  @test_util.run_in_graph_and_eager_modes
  def testNoMatrixNoCrash(self):
    # Round-about way of creating an empty variant tensor that works in both
    # graph and eager modes.
    no_matrix = array_ops.reshape(dense_to_csr_sparse_matrix([[0.0]]), [1])[0:0]
    with self.assertRaisesRegex(
        (ValueError, errors.InvalidArgumentError),
        "(Invalid input matrix)|(Shape must be rank 0)"):
      sparse_csr_matrix_ops.sparse_matrix_nnz(no_matrix)
CVE-2022-41902 (C++, published 2022-12-06T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/grappler/utils/functions.cc
Commit message: Fix OOB write in grappler.

Discovered via internal fuzzing.

PiperOrigin-RevId: 482097391


Vulnerable code:

Fixed code:
    if (attr.first >= inputs.size()) {
      return errors::InvalidArgument("Invalid attribute index, got ",
                                     attr.first, " but expected less than ",
                                     inputs.size());
    }
CVE-2022-41907 (Python, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-131 \u2014 Incorrect Calculation of Buffer Size
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/image/resize_nearest_neighbor_op.cc
tensorflow/python/ops/image_ops_test.py
Commit message: Fix tf.raw_ops.ResizeNearestNeighborGrad vulnerability with large dimensions.

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 479141644


Vulnerable code:
    OP_REQUIRES_OK(
        context,
        context->allocate_output(
            0, TensorShape({batch_size, out_height, out_width, channels}),
            &output));

Fixed code:
    TensorShape shape;
    OP_REQUIRES_OK(context,
                   TensorShape::BuildTensorShape(
                       {batch_size, out_height, out_width, channels}, &shape));
    OP_REQUIRES_OK(context, context->allocate_output(0, shape, &output));
class ResizeNearestNeighborGrad(test_util.TensorFlowTestCase):

  def testSizeTooLarge(self):
    align_corners = True
    half_pixel_centers = False
    grads = constant_op.constant(1, shape=[1, 8, 16, 3], dtype=dtypes.float16)
    size = constant_op.constant([1879048192, 1879048192],
                                shape=[2],
                                dtype=dtypes.int32)
    with self.assertRaisesRegex(errors.InvalidArgumentError,
                                r"Encountered overflow when multiplying"):
      self.evaluate(
          gen_image_ops.ResizeNearestNeighborGrad(
              grads=grads,
              size=size,
              align_corners=align_corners,
              half_pixel_centers=half_pixel_centers))
CVE-2022-41908 (Python, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/python/lib/core/py_func.cc
tensorflow/python/ops/script_ops_test.py
Commit message: Replace CHECK with returning an InternalError on failing to create python tuple

Returns InternalError if a non UTF-8 string is passed in as token, instead of crashing.

PiperOrigin-RevId: 478123498


Vulnerable code:
// Givens the 'call', prepares the token and inputs as a python tuple
// that is appropriate for calling the trampoline.
  CHECK(*tuple);

Fixed code:
// Given the 'call', prepares the token and inputs as a python tuple that is
// appropriate for calling the trampoline.
  if (*tuple == nullptr) {
    return errors::Internal(
        "Failed to create python tuple. Please make sure `token` is a "
        "well-formed UTF-8 string.");
  }
from tensorflow.python.framework import errors
from tensorflow.python.ops import gen_script_ops
  @test_util.run_in_graph_and_eager_modes
  def test_fail_on_non_utf8_token(self):
    value = constant_op.constant(value=[1, 2])
    token = b"\xb0"
    data_type = [dtypes.int32]
    with self.assertRaises((errors.InternalError, UnicodeDecodeError)):
      self.evaluate(
          gen_script_ops.py_func(input=[value], token=token, Tout=data_type))
CVE-2022-41909 (Python, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/composite_tensor_ops.cc
tensorflow/python/kernel_tests/composite_tensor_ops_test.py
Commit message: [Security] Add a check for empty variant tensor input to CompositeTensorVariantToComponents.

So an exception will be raised instead of segfault.

PiperOrigin-RevId: 474397914


Vulnerable code:

Fixed code:
#include "tensorflow/core/framework/op_requires.h"
    OP_REQUIRES(
        context, encoded_t.flat<Variant>().size() > 0,
        errors::InvalidArgument("Input `encoded` must not be an empty variant "
                                "tensor, but got ",
                                encoded_t.DebugString()));
from tensorflow.python.framework import constant_op
from tensorflow.python.ops import gen_composite_tensor_ops
  def testDecodingEmptyNonScalarTensorError(self):
    if not context.executing_eagerly():
      # Creating a variant tensor of an empty list is not allowed in eager mode.
      return

    with self.assertRaisesRegex(errors.InvalidArgumentError,
                                'must not be an empty variant tensor'):
      gen_composite_tensor_ops.CompositeTensorVariantToComponents(
          encoded=constant_op.constant([], dtype=dtypes.variant),
          metadata='',
          Tcomponents=[dtypes.int32])
CVE-2022-41909 (Python, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/composite_tensor_ops.cc
tensorflow/python/kernel_tests/composite_tensor_ops_test.py
Commit message: [Security] Raise an exception when input to CompositeTensorVariantToComponents is not a valid CompositeTensorVariant tensor.

So TF won't crash.

PiperOrigin-RevId: 474594628


Vulnerable code:

Fixed code:
    OP_REQUIRES(context, encoded != nullptr,
                errors::InvalidArgument("The input `encoded` is not a valid "
                                        "CompositeTensorVariant tensor, got ",
                                        encoded_t.DebugString()));
from tensorflow.python.ops import gen_list_ops
  def testDecodingInvalidEncodedInputError(self):
    with self.assertRaisesRegex(errors.InvalidArgumentError,
                                'not a valid CompositeTensorVariant tensor'):
      self.evaluate(
          gen_composite_tensor_ops.CompositeTensorVariantToComponents(
              encoded=gen_list_ops.EmptyTensorList(
                  element_dtype=dtypes.int32,
                  element_shape=[1, 2],
                  max_num_elements=2),
              metadata='',
              Tcomponents=[dtypes.int32]))
CVE-2022-41910 (C++, published 2022-12-06T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/grappler/utils/functions.cc
Commit message: Fix OOB write in grappler.

Discovered via internal fuzzing.

PiperOrigin-RevId: 482097391


Vulnerable code:

Fixed code:
    if (attr.first >= inputs.size()) {
      return errors::InvalidArgument("Invalid attribute index, got ",
                                     attr.first, " but expected less than ",
                                     inputs.size());
    }
CVE-2022-41911 (C++, published 2022-11-18T22:15Z)
Description: value: TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/framework/tensor.cc
Commit message: Resolve a sanitizer issue with invalid char -> bool conversion.

When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash.

To fix, we're creating a mutable `char` array to convert the chars to 0/1, according to bool rules.

Discovered via internal fuzzing.

PiperOrigin-RevId: 482297563


Vulnerable code:
string SummarizeArray(int64_t limit, int64_t num_elts,
                      const TensorShape& tensor_shape, const char* data,
                      const bool print_v2) {
  const T* array = reinterpret_cast<const T*>(data);


Fixed code:
#include <memory>
string SummarizeArrayInternal(int64_t limit, int64_t num_elts,
                              const TensorShape& tensor_shape, const T* array,
                              const bool print_v2) {

template <typename T>
string SummarizeArray(int64_t limit, int64_t num_elts,
                      const TensorShape& tensor_shape, const char* data,
                      const bool print_v2) {
  const T* array = reinterpret_cast<const T*>(data);
  return SummarizeArrayInternal<T>(limit, num_elts, tensor_shape, array,
                                   print_v2);
}

template <>
string SummarizeArray<bool>(int64_t limit, int64_t num_elts,
                            const TensorShape& tensor_shape, const char* data,
                            const bool print_v2) {
  // We first convert all chars to be 0/1 to not get InvalidEnumValue sanitizer
  // error
  auto mutable_data = std::unique_ptr<char[]>(new char[num_elts]);
  for (int64_t i = 0; i < num_elts; ++i)
    mutable_data.get()[i] = data[i] ? 1 : 0;
  bool* array = reinterpret_cast<bool*>(mutable_data.get());
  return SummarizeArrayInternal<bool>(limit, num_elts, tensor_shape, array,
                                      print_v2);
}
CVE-2023-25659 (C++, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the parameter `indices` for `DynamicStitch` does not match the shape of the parameter `data`, it can trigger an stack OOB read. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/compiler/tf2xla/kernels/dynamic_stitch_op.cc
tensorflow/core/kernels/dynamic_stitch_op.cc
tensorflow/python/kernel_tests/data_structures/dynamic_stitch_op_test.py
Commit message: Add out of bounds array check to dynamic_stitch_op.

PiperOrigin-RevId: 506418249


Vulnerable code:
            OP_REQUIRES(
                c, FastBoundsCheck(index, first_dim_size),
                errors::InvalidArgument("indices[", i, "] is out of range"));
            OP_REQUIRES(
                c, FastBoundsCheck(index, first_dim_size),
                errors::InvalidArgument("indices[", i, "] is out of range"));

Fixed code:
        OP_REQUIRES(
            ctx, index >= 0,
            errors::InvalidArgument("indices[", index, "] is out of range"));

    for (const Tensor& indices : *indices_inputs) {
      auto indices_vec = indices.flat<int32>();

      for (int i = 0; i < indices_vec.size(); i++) {
        int32_t index = internal::SubtleMustCopy(indices_vec(i));
        OP_REQUIRES(
            c, FastBoundsCheck(index, *first_dim_size),
            errors::InvalidArgument("indices[", i, "] is out of range"));
      }
    }

  def testOutOfBoundsIndexRaisesInvalidArgument(self):
    with self.assertRaisesRegex(errors.InvalidArgumentError, "out of range"):
      indices = [[-1000], [405], [519], [758], [1015]]
      data = [
          [110.27793884277344],
          [120.29475402832031],
          [157.2418212890625],
          [157.2626953125],
          [188.45382690429688],
      ]

      self.evaluate(self.stitch_op(indices, data))
CVE-2023-25660 (C++, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/framework/tensor.cc
Commit message: Quick fix for a vuln in printing empty tensors.

PiperOrigin-RevId: 503308327


Vulnerable code:

Fixed code:
  if (data == nullptr) {
    return strings::StrCat("");  // we already print type and shape
  }
CVE-2023-25661 (Python, published 2023-03-27T20:15Z)
Description: value: TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack. A proof of concept can be constructed with the `Convolution3DTranspose` function. This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a `Convolution3DTranspose` call. This issue has been patched and users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/conv_grad_ops_3d.cc
tensorflow/python/kernel_tests/nn_ops/conv3d_transpose_test.py
Commit message: Fix nn.conv3d_transpose security vulnerability with illegal input shape

PiperOrigin-RevId: 487000656


Vulnerable code:
        x_value, f_value, y_shape, strides, data_format='NCDHW')

Fixed code:
    for (std::size_t i = 0; i < input_shape.dims(); ++i) {
      if (input_shape.dim_size(i) == 0) {
        return;
      }
    }
        x_value, f_value, y_shape, strides, data_format="NCDHW")
  def testConv3DTransposeZeroShapeDoNotRaiseError(self):
    with self.cached_session():
      x_value = np.zeros([10, 0, 2, 3, 3])
      f_value = np.ones((3, 3, 3, 3, 3))
      y_shape = np.stack([10, 0, 2, 3, 3])
      output = nn_ops.conv3d_transpose(
          x_value,
          f_value,
          y_shape,
          strides=(1, 1, 1),
          data_format="NDHWC",
          padding="SAME",
      )
      _ = self.evaluate(output)
CVE-2023-25663 (Python, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/tensor_array_ops.cc
tensorflow/python/kernel_tests/data_structures/tensor_array_ops_test.py
Commit message: Fixing null pointer read in TensorArrayConcat when the step container is missing.

PiperOrigin-RevId: 504332194


Vulnerable code:
    TF_RETURN_IF_ERROR(
        ctx->step_container()->Lookup(rm, container + ta_handle, tensor_array));

Fixed code:
    ScopedStepContainer* sc = ctx->step_container();
    if (sc == nullptr) return errors::Internal("No step container.");
    TF_RETURN_IF_ERROR(sc->Lookup(rm, container + ta_handle, tensor_array));
  def testTensorArrayConcatFailsWhenMissingStepContainer(self):
    @def_function.function
    def func():
      y = data_flow_ops.TensorArrayConcatV2(
          handle=["a", "b"],
          flow_in=0.1,
          dtype=dtypes.int32,
          element_shape_except0=1,
      )
      return y

    with self.assertRaisesRegex(
        errors.NotFoundError, "Container .* does not exist"
    ):
      self.evaluate(func())