Headline
CVE-2022-35966: Fix QuantizedAvgPool invalid rank issue. · tensorflow/tensorflow@7cdf9d4
TensorFlow is an open source platform for machine learning. If QuantizedAvgPool is given min_input or max_input tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7cdf9d4d2083b739ec81cfdace546b0c99f50622. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
@@ -15,18 +15,18 @@ limitations under the License.
// See docs in …/ops/nn_ops.cc.
#include “tensorflow/core/framework/op_requires.h” #include “tensorflow/core/platform/errors.h” #define EIGEN_USE_THREADS
#include “third_party/eigen3/unsupported/Eigen/CXX11/Tensor” #include “tensorflow/core/framework/numeric_op.h” #include “tensorflow/core/framework/op_kernel.h” #include “tensorflow/core/framework/op_requires.h” #include “tensorflow/core/framework/tensor.h” #include “tensorflow/core/framework/tensor_shape.h” #include “tensorflow/core/kernels/ops_util.h” #include “tensorflow/core/kernels/pooling_ops_common.h” #include “tensorflow/core/lib/core/errors.h” #include “tensorflow/core/platform/errors.h” #include “tensorflow/core/platform/logging.h” #include “tensorflow/core/util/padding.h” #include “tensorflow/core/util/tensor_format.h” @@ -67,8 +67,20 @@ class QuantizedAvgPoolingOp : public OpKernel { return; }
const float min_input = context->input(1).flat<float>()(0); const float max_input = context->input(2).flat<float>()(0); const Tensor& min_input_tensor = context->input(1); const Tensor& max_input_tensor = context->input(2); OP_REQUIRES(context, TensorShapeUtils::IsScalar(min_input_tensor.shape()), errors::InvalidArgument( "min_input shape must be rank 0 but is rank ", min_input_tensor.dims(), ", received shape: ", min_input_tensor.shape())); OP_REQUIRES(context, TensorShapeUtils::IsScalar(max_input_tensor.shape()), errors::InvalidArgument( "max_input shape must be rank 0 but is rank ", max_input_tensor.dims(), ", received shape: ", max_input_tensor.shape())); const float min_input = context->input(1).scalar<float>()(); const float max_input = context->input(2).scalar<float>()();
OP_REQUIRES(context, params.depth_window == 1, errors::Unimplemented("Non-spatial pooling is not " @@ -119,20 +131,20 @@ class QuantizedMaxPoolingOp : public MaxPoolingOp<Device, T> { : MaxPoolingOp<Device, T>(context) {}
void Compute(OpKernelContext* context) override { auto min_input_tensor = context->input(1); auto max_input_tensor = context->input(2); OP_REQUIRES( context, min_input_tensor.NumElements() == 1, errors::InvalidArgument( "min_input must be a scalar float value, got tensor with shape ", min_input_tensor.shape())); OP_REQUIRES( context, max_input_tensor.NumElements() == 1, errors::InvalidArgument( "max_input must be a scalar float value, got tensor with shape ", max_input_tensor.shape())); const float min_input = context->input(1).flat<float>()(0); const float max_input = context->input(2).flat<float>()(0); const Tensor& min_input_tensor = context->input(1); const Tensor& max_input_tensor = context->input(2); OP_REQUIRES(context, TensorShapeUtils::IsScalar(min_input_tensor.shape()), errors::InvalidArgument( "min_input shape must be rank 0 but is rank ", min_input_tensor.dims(), ", received shape: ", min_input_tensor.shape())); OP_REQUIRES(context, TensorShapeUtils::IsScalar(max_input_tensor.shape()), errors::InvalidArgument( "max_input shape must be rank 0 but is rank ", max_input_tensor.dims(), ", received shape: ", max_input_tensor.shape())); const float min_input = context->input(1).scalar<float>()(); const float max_input = context->input(2).scalar<float>()(); MaxPoolingOp<Device, T>::Compute(context); Tensor* output_min = nullptr; OP_REQUIRES_OK(context, context->allocate_output(1, {}, &output_min));
Related news
### Impact If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. ```python import tensorflow as tf ksize = [1, 2, 2, 1] strides = [1, 2, 2, 1] padding = "SAME" input = tf.constant(1, shape=[1,4,4,2], dtype=tf.quint8) min_input = tf.constant([], shape=[0], dtype=tf.float32) max_input = tf.constant(0, shape=[1], dtype=tf.float32) tf.raw_ops.QuantizedAvgPool(input=input, min_input=min_input, max_input=max_input, ksize=ksize, strides=strides, padding=padding) ``` ### Patches We have patched the issue in GitHub commit [7cdf9d4d2083b739ec81cfdace546b0c99f50622](https://github.com/tensorflow/tensorflow/commit/7cdf9d4d2083b739ec81cfdace546b0c99f50622). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. ### For more information Plea...