CVE-2022-36014 (published 2022-09-16T23:15Z)

TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: A. Unique TensorFlower
author_date: 2022-06-08 10:27:21-07:00
msg: [TF] NodeDefs without an op name are invalid, return error on import

PiperOrigin-RevId: 453711926
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: graphdef_import.cc
change_type: ModificationType.MODIFY
diff: @@ -746,6 +746,9 @@ StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
 Status GraphDefImporter::ConvertNodeDef(OpBuilder &builder, ConversionState &s,
                                         const NodeDef &node) {
   VLOG(4) << "Importing: " << node.name();
+  if (node.op().empty())
+    return InvalidArgument("Node ", node.name(), " has an empty op name");
+
   OperationState state(ConvertLocation(node), absl::StrCat("tfg.", node.op()));
 
   // The GraphImporter does light shape inference, but here we will defer all of

programming_language: C++
filename: invalid_op_name.pbtxt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,20 @@
+# RUN: not tfg-translate -graphdef-to-mlir %s 2>&1 | FileCheck %s
+
+# CHECK: Node  has an empty op name
+
+library {
+  function {
+    signature {
+      name: "\\344\\264\\264"
+      description: "value"
+      is_distributed_communication: true
+    }
+    node_def {
+      input: "|"
+    }
+    control_ret {
+      key: ""
+      value: ""
+    }
+  }
+}
\ No newline at end of file

programming_language: JavaScript
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: A. Unique TensorFlower
author_date: 2022-05-19 20:00:39-07:00
msg: [tfg] Fix null type attribute

Type attributes can be null and the input should be `dyn_cast_or_null`.

PiperOrigin-RevId: 449889247
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: graphdef_import.cc
change_type: ModificationType.MODIFY
diff: @@ -699,7 +699,8 @@ StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
                                                 SmallVectorImpl<Type> &types) {
   // Check whether a type list attribute is specified.
   if (!arg_def.type_list_attr().empty()) {
-    if (auto v = attrs.get(arg_def.type_list_attr()).dyn_cast<ArrayAttr>()) {
+    if (auto v =
+            attrs.get(arg_def.type_list_attr()).dyn_cast_or_null<ArrayAttr>()) {
       for (Attribute attr : v) {
         if (auto dtype = attr.dyn_cast<TypeAttr>()) {
           types.push_back(UnrankedTensorType::get(dtype.getValue()));
@@ -716,7 +717,8 @@ StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
   unsigned num = 1;
   // Check whether a number attribute is specified.
   if (!arg_def.number_attr().empty()) {
-    if (auto v = attrs.get(arg_def.number_attr()).dyn_cast<IntegerAttr>()) {
+    if (auto v =
+            attrs.get(arg_def.number_attr()).dyn_cast_or_null<IntegerAttr>()) {
       num = v.getValue().getZExtValue();
     } else {
       return NotFound("Type attr not found: ", arg_def.number_attr());
@@ -731,7 +733,7 @@ StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
     return InvalidArgument("Arg '", arg_def.name(),
                            "' has invalid type and no type attribute");
   } else {
-    if (auto v = attrs.get(arg_def.type_attr()).dyn_cast<TypeAttr>()) {
+    if (auto v = attrs.get(arg_def.type_attr()).dyn_cast_or_null<TypeAttr>()) {
       dtype = v.getValue();
     } else {
       return NotFound("Type attr not found: ", arg_def.type_attr());

programming_language: C++
filename: invalid_backedge_input_size.pbtxt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,21 @@
+# RUN: not tfg-translate -graphdef-to-mlir %s 2>&1 | FileCheck %s
+
+# CHECK: Type attr not found
+
+library {
+  function {
+    signature {
+      name: "\344\264\264"
+      description: "value"
+      is_distributed_communication: true
+    }
+    node_def {
+      op: "Const"
+      input: "|"
+    }
+    control_ret {
+      key: ""
+      value: ""
+    }
+  }
+}
\ No newline at end of file

programming_language: JavaScript