Vulnerability: Heap OOB in `QuantizeAndDequantizeV3` ### Impact
An attacker can read data outside of bounds of heap allocated buffer in `tf.raw_ops.QuantizeAndDequantizeV3`:

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV3(
  input=[2.5,2.5], input_min=[0,0], input_max=[1,1], num_bits=[30],
  signed_input=False, range_given=False, narrow_range=False, axis=3)
```   

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/11ff7f80667e6490d7b5174aa6bf5e01886e770f/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L237) does not validate the value of user supplied `axis` attribute before using it to index in the array backing the `input` argument:

```cc
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

### Patches
We have patched the issue in GitHub commit [99085e8ff02c3763a0ec2263e44daec416f6a387](https://github.com/tensorflow/tensorflow/commit/99085e8ff02c3763a0ec2263e44daec416f6a387).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-h9px-9vqg-222h
CWE: CWE-125
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/core/kernels/quantize_and_dequantize_op.cc
Commit message: Fix `tf.raw_ops.QuantizeAndDequantizeV3` array index failure.

PiperOrigin-RevId: 370577691
Change-Id: Ifeae64212f6bcd139435824fa2748d1329213c4c
Commit author: Amit Patankar

Vulnerable version (before fix):
 See the License for the specific language governing permissions and limitations under the License. ==============================================================================*/  #define EIGEN_USE_THREADS  #if (defined(GOOGLE_CUDA) && GOOGLE_CUDA) || \ class QuantizeAndDequantizeV3Op : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& input = ctx->input(0);     const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);     Tensor* output = nullptr;     OP_REQUIRES_OK(ctx, ctx->allocate_output(0, input.shape(), &output));

Fixed version (after fix):
 See the License for the specific language governing permissions and limitations under the License. ==============================================================================*/  #include "tensorflow/core/framework/op_requires.h" #define EIGEN_USE_THREADS  #if (defined(GOOGLE_CUDA) && GOOGLE_CUDA) || \ class QuantizeAndDequantizeV3Op : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& input = ctx->input(0);     OP_REQUIRES(ctx, axis_ < input.dims(),                 errors::InvalidArgument(                     "Axis requested is larger than input dimensions. Axis: ",                     axis_, " Input Dimensions: ", input.dims()));     const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);     Tensor* output = nullptr;     OP_REQUIRES_OK(ctx, ctx->allocate_output(0, input.shape(), &output));

Patch:
patch: @@ -13,6 +13,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ==============================================================================*/
 
+#include "tensorflow/core/framework/op_requires.h"
 #define EIGEN_USE_THREADS
 
 #if (defined(GOOGLE_CUDA) && GOOGLE_CUDA) || \
@@ -234,6 +235,10 @@ class QuantizeAndDequantizeV3Op : public OpKernel {
 
   void Compute(OpKernelContext* ctx) override {
     const Tensor& input = ctx->input(0);
+    OP_REQUIRES(ctx, axis_ < input.dims(),
+                errors::InvalidArgument(
+                    "Axis requested is larger than input dimensions. Axis: ",
+                    axis_, " Input Dimensions: ", input.dims()));
     const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
     Tensor* output = nullptr;
     OP_REQUIRES_OK(ctx, ctx->allocate_output(0, input.shape(), &output));
path: tensorflow/core/kernels/quantize_and_dequantize_op.cc