刘力源

The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming `input(0)`, `input(1)`, and `input(2)` to be scalar. This issue can be triggered by providing non-scalar inputs to the SobolSampleOp function.

The `UnbatchGradOp` function in TensorFlow takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program. It also requires its argument `batch index` to contain three times the number of elements as indicated in its `batch index.dim size(0)`. An incorrect `batch index` can trigger a `CHECK` failure and crash the program.

The issue arises when `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, resulting in a `CHECK` fail that can be used to trigger a denial of service attack. There are no known workarounds for this issue.

The issue occurs when `tf.quantization.fake quant with min max vars per channel gradient` receives input `min` or `max` of rank other than 1, resulting in a `CHECK` fail that can trigger a denial of service attack.

TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element shape` of a rank greater than one, they give a `CHECK` fail that can trigger a denial of service attack.

The issue occurs when `TensorListFromTensor` receives an `element shape` of a rank greater than one, resulting in a `CHECK` fail that can trigger a denial of service attack. There are no known workarounds for this issue.

The issue occurs when the `SetSize` function receives an input `set shape` that is not a 1D tensor, resulting in a `CHECK` failure that can be used to trigger a denial of service attack. There are no known workarounds for this issue.

The issue occurs when `CollectiveGather` receives a scalar input `input`, resulting in a `CHECK` failure that can be used to trigger a denial of service attack. There are no known workarounds for this issue.

The issue occurs when `AudioSummaryV2` receives an input `sample rate` with more than one element, resulting in a `CHECK` failure that can be used to trigger a denial of service attack. There are no known workarounds for this issue.

The issue arises when `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, resulting in a null dereference. Additionally, the `Eig` function can be fed an incorrect `Tout` input, leading to a `CHECK` fail that can trigger a denial of service attack. The `Eig` function is vulnerable when given specific inputs, such as `arg 0` with a shape of (2, 2) and `arg 1` set to `tf.complex128`. There are no known workarounds for this issue.

The issue occurs when the `DrawBoundingBoxes` function receives an input `boxes` that is not of dtype `float`, resulting in a `CHECK` fail that can trigger a denial of service attack. This can happen when the input `boxes` has a different data type, such as `tf.half`. The estimated number of potentially affected devices is not provided. There are no known real-world incidents where this issue was exploited.

The issue occurs when the `Unbatch` function receives a nonscalar input `id`, resulting in a `CHECK` fail that can trigger a denial of service attack. This can happen when the `Unbatch` function is called with specific arguments, such as `batched tensor`, `batch index`, and `id`. The estimated number of potentially affected devices worldwide is not available. There are no known real-world incidents where this issue was exploited.

The issue occurs when `RandomPoissonV2` receives large input shape and rates, resulting in a `CHECK` fail that can trigger a denial of service attack. This can happen when the `shape` and `rate` parameters are set to large values. For example, when `arg 0` is set to a large shape and `arg 1` is set to a large rate, the `tf.raw ops.RandomPoissonV2` function can fail and cause a denial of service attack.

The issue occurs when `tf.random.gamma` receives large input shape and rates, resulting in a `CHECK` fail that can trigger a denial of service attack. This can happen when the function is called with specific arguments, such as large shapes and rates. There are no known workarounds for this issue.

The issue occurs when `tf.quantization.fake quant with min max vars gradient` receives input `min` or `max` that is nonscalar, resulting in a `CHECK` fail that can trigger a denial of service attack. There are no known workarounds for this issue.