CVE-2023-25801 (published 2023-03-25T00:15Z)

TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Zhufeng Pan
author_date: 2023-01-12 13:26:50-08:00
msg: Fix security vulnerability with FractionalMax(AVG)Pool with illegal pooling_ratio

PiperOrigin-RevId: 501651261
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: fractional_avg_pool_op.cc
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ class FractionalAvgPoolOp : public OpKernel {
                       pooling_ratio_[i]));
     }
     OP_REQUIRES(
-        context, pooling_ratio_[0] == 1 || pooling_ratio_[3] == 1,
+        context, pooling_ratio_[0] == 1 && pooling_ratio_[3] == 1,
         errors::Unimplemented("Fractional average pooling is not yet "
                               "supported on the batch nor channel dimension."));
     OP_REQUIRES_OK(context, context->GetAttr("deterministic", &deterministic_));

programming_language: C++
filename: fractional_max_pool_op.cc
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ class FractionalMaxPoolOp : public OpKernel {
     }
 
     OP_REQUIRES(
-        context, pooling_ratio_[0] == 1 || pooling_ratio_[3] == 1,
+        context, pooling_ratio_[0] == 1 && pooling_ratio_[3] == 1,
         errors::Unimplemented("Fractional max pooling is not yet "
                               "supported on the batch nor channel dimension."));
 

programming_language: C++
filename: fractional_avg_pool_op_test.py
change_type: ModificationType.MODIFY
diff: @@ -351,7 +351,7 @@ class FractionalAvgTest(test.TestCase):
             name=None)
         self.evaluate(result)
 
-  def testPoolingRatioValueOutOfRange(self):
+  def testPoolingRatioIllegalSmallValue(self):
     with self.cached_session() as _:
       # Whether turn on `TF2_BEHAVIOR` generates different error messages
       with self.assertRaisesRegex(
@@ -368,6 +368,16 @@ class FractionalAvgTest(test.TestCase):
         )
         self.evaluate(result)
 
+  def testPoolingIllegalRatioForBatch(self):
+    with self.cached_session() as _:
+      with self.assertRaises(errors.UnimplementedError):
+        result = nn_ops.gen_nn_ops.fractional_avg_pool(
+            np.zeros([3, 30, 50, 3]),
+            [2, 3, 1.5, 1],
+            True,
+            True)
+        self.evaluate(result)
+
 
 class FractionalAvgPoolGradTest(test.TestCase):
   """Tests for FractionalAvgPoolGrad.

programming_language: Python
filename: fractional_max_pool_op_test.py
change_type: ModificationType.MODIFY
diff: @@ -338,7 +338,7 @@ class FractionalMaxPoolTest(test.TestCase):
             name=None)
         self.evaluate(result)
 
-  def testPoolingRatioValueOutOfRange(self):
+  def testPoolingRatioIllegalSmallValue(self):
     with self.cached_session() as _:
       # Whether turn on `TF2_BEHAVIOR` generates different error messages
       with self.assertRaisesRegex(
@@ -355,6 +355,16 @@ class FractionalMaxPoolTest(test.TestCase):
         )
         self.evaluate(result)
 
+  def testPoolingIllegalRatioForBatch(self):
+    with self.cached_session() as _:
+      with self.assertRaises(errors.UnimplementedError):
+        result = nn_ops.fractional_max_pool(
+            np.zeros([3, 30, 50, 3]),
+            [2, 3, 1.5, 1],
+            True,
+            True)
+        self.evaluate(result)
+
 
 class FractionalMaxPoolGradTest(test.TestCase):
   """Tests for FractionalMaxPoolGrad.

programming_language: Python