Kang Hong Jin

TensorFlow is an open source platform for machine learning. An input `sparse matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in `tf.raw ops.SparseMatrixNNZ`.

The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming `input(0)`, `input(1)`, and `input(2)` to be scalar. This issue can be triggered by providing non-scalar inputs to the SobolSampleOp function.

The `UnbatchGradOp` function in TensorFlow takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program. It also requires its argument `batch index` to contain three times the number of elements as indicated in its `batch index.dim size(0)`. An incorrect `batch index` can trigger a `CHECK` failure and crash the program.

The issue arises in `core/kernels/list kernels.cc's TensorListReserve` where `num elements` is assumed to be a tensor of size 1. When a `num elements` of more than 1 element is provided, then `tf.raw ops.TensorListReserve` fails the `CHECK EQ` in `CheckIsAlignedAndSingleElement`. This vulnerability has been reported by Kang Hong Jin from Singapore Management University.

The implementation of `tf.reshape` op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue can be exploited by passing a large shape to the `tf.reshape` function, causing the program to crash. The estimated number of potentially affected devices worldwide is not available. There are no known real-world incidents where this issue was exploited.

The issue occurs when the `tf.sparse.cross` function receives an input `separator` that is not a scalar, resulting in a `CHECK` fail that can be used to trigger a denial of service attack. This can happen when the `separator` input is not properly validated, allowing an attacker to cause the program to crash or become unresponsive.

The issue arises when `EmptyTensorList` receives an input `element shape` with more than one dimension, resulting in a `CHECK` fail that can be used to trigger a denial of service attack. This can be exploited by providing a specially crafted input to the `tf.raw ops.EmptyTensorList` function, such as `element shape=tf.ones(dtype=tf.int32, shape=[1, 0])`.

The issue occurs when the `tf.linalg.matrix rank` function receives an empty input `a`, causing the GPU kernel to give a `CHECK` fail that can be used to trigger a denial of service attack. This can be achieved by passing an empty tensor to the `tf.linalg.matrix rank` function, such as `tf.constant([], shape=[0, 1, 1], dtype=tf.float32)`.