Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
692 results · Clear filters · Feed
-
Medium 5.9
Null dereference on MLIR on empty function attributes in TensorFlow
TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit aed36912609fc07229b4d0a7b44f3f48efc00…
-
Medium 5.9
Null dereference on MLIR on empty function attributes in TensorFlow
TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc…
-
Medium 5.9
Null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` in TensorFlow
TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The f…
-
Medium 5.9
`CHECK` fail in `CollectiveGather` in TensorFlow
TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c1f491817dec39a26…
-
Medium 5.9
`CHECK` fail in `SetSize` in TensorFlow
TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b…
-
Medium 5.9
`CHECK` fail in `TensorListFromTensor` in TensorFlow
TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db…
-
Medium 5.9
`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlow
TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element_shape` of a rank greater than one, they give a `CHECK` fail that can trigger a denial of service attack. We have patched the iss…
-
Medium 5.9
`CHECK` fail in `Conv2DBackpropInput` in TensorFlow
TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empty `out_backprop` inputs (e.g. `[3, 1, 0, 1]`), the current CPU/GPU kernels `CHECK` fail (one with dnnl, the other with cudnn). This can be used to trigger a de…
-
Medium 5.9
`CHECK` fail in `EmptyTensorList` in TensorFlow
TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHu…
-
Medium 5.9
`CHECK` fail in `tf.sparse.cross` in TensorFlow
TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 83d…
-
Medium 5.9
`CHECK` fail in `AudioSummaryV2` in TensorFlow
TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub …
-
Medium 5.9
`CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs` in TensorFlow
TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status. We have patched the issue in Gi…
-
Medium 5.9
`CHECK` fail in `FakeQuantWithMinMaxVarsGradient` in TensorFlow
TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is nonscalar, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the …
-
Medium 5.9
`CHECK` fail in `tf.random.gamma` in TensorFlow
TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f…
-
Medium 5.9
`CHECK` fail in `RandomPoissonV2` in TensorFlow
TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f…
-
Medium 5.9
`CHECK` fail in `Unbatch` in TensorFlow
TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189…
-
Medium 5.9
`CHECK` fail in `DrawBoundingBoxes` in TensorFlow
TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a `CHECK` fail that can trigger a denial of service attack. We have patched the issue in GitHub commit da0d65…
-
Medium 5.9
`CHECK` fail in `QuantizeAndDequantizeV3` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub com…
-
Medium 5.9
`CHECK` fail in `RaggedTensorToVariant` in TensorFlow
TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We ha…
-
Medium 5.9
`CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel` in TensorFlow
TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched t…
-
Medium 5.9
`CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient` in TensorFlow
TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_per_channel_gradient` receives input `min` or `max` of rank other than 1, it gives a `CHECK` fail that can trigger a denial of service attack. We ha…
-
Medium 5.9
Segfault in `RaggedBincount` in TensorFlow
TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f…
-
Medium 5.9
`CHECK` fail in `DenseBincount` in TensorFlow
TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tensor `input` or to be length-0. A different `weights` shape will trigger a `CHECK` fail that can be use…
-
Medium 5.9
`CHECK` fail in `LRNGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit b…
-
Medium 5.9
`CHECK` fail in `ParameterizedTruncatedNormal` in TensorFlow
TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64` results in a mismatched type `CHECK` fail that can be used to trigger a denial of service attack. We…
-
Medium 5.9
`CHECK` fail in `Save` and `SaveSlices` in TensorFlow
TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commi…
-
Medium 5.9
`CHECK` fail in `MaxPool` in TensorFlow
TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input tensor `input`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service at…
-
Medium 5.9
`CHECK` fail in `tf.linalg.matrix_rank` in TensorFlow
TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c55b47…
-
Medium 5.9
Segfault in `SparseBincount` in TensorFlow
TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack.…
-
Medium 5.9
`CHECK` fail in `FractionalMaxPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. `FractionalMaxPoolGrad` validates its inputs with `CHECK` failures instead of with returning errors. If it gets incorrectly sized inputs, the `CHECK` failure can be used to trigger a denial of servic…
-
Medium 5.9
Segfault in `QuantizedRelu` and `QuantizedRelu6`
TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_features`, it results in a segfault that can be used to trigger a denial of service attack. We have patche…
-
Medium —
`cell-project` used incorrect variance when projecting through `&Cell<T>`
## Overview The issue lies in the implementation of the `cell_project` macro which used `field as *const _` instead of `field as *mut _`. The problem being that `*const T` is covariant in `T` while `*mut T` is invariant in `T`. Keep in mind that `&Cell<T>` is…
-
Medium 5.9
Segfault in `QuantizeDownAndShrinkRange` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in…
-
Medium 5.9
Segfault in `QuantizedBiasAdd` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have pat…
-
Medium 5.9
Segfault in `QuantizedMatMul` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHu…
-
Medium 5.4
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
-
Medium 5.9
`CHECK` fail in `FakeQuantWithMinMaxVars` in TensorFlow
TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHu…
-
Medium 5.9
`CHECK` fail in `Conv2DBackpropInput` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise, it gives a `CHECK` failure which can be used to trigger a denial of service attack. We have patched …
-
Medium 5.9
Segfault in `QuantizedInstanceNorm` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub …
-
Medium 5.9
`CHECK` fail in `AvgPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched th…