PT-2026-59828 · Pypi · Tensorflow
Published
2026-07-09
·
Updated
2026-07-09
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Impact
The [implementation of shape inference for
ConcatV2](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/common shape fns.cc#L1961-L2059) can be used to trigger a denial of service attack via a segfault caused by a type confusion:python
import tensorflow as tf
@tf.function
def test():
y = tf.raw ops.ConcatV2(
values=[[1,2,3],[4,5,6]],
axis = 0xb500005b)
return y
test()The
axis argument is translated into concat dim in the ConcatShapeHelper helper function. Then, a value for min rank is computed based on concat dim. This is then used to validate that the values tensor has at least the required rank:cc
int64 t concat dim;
if (concat dim t->dtype() == DT INT32) {
concat dim = static cast<int64 t>(concat dim t->flat<int32>()(0));
} else {
concat dim = concat dim t->flat<int64 t>()(0);
}
// Minimum required number of dimensions.
const int min rank = concat dim < 0 ? -concat dim : concat dim + 1;
// ...
ShapeHandle input = c->input(end value index - 1);
TF RETURN IF ERROR(c->WithRankAtLeast(input, min rank, &input));However, [
WithRankAtLeast](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/shape inference.cc#L345-L358) receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented:cc
Status InferenceContext::WithRankAtLeast(ShapeHandle shape, int64 t rank,
ShapeHandle* out) {
if (rank > kint32max) {
return errors::InvalidArgument("Rank cannot exceed kint32max");
}
// ...
}Due to the fact that
min rank is a 32-bits value and the value of axis, the rank argument is a negative value, so the error check is bypassed.Patches
We have patched the issue in GitHub commit 08d7b00c0a5a20926363849f611729f53f3ec022.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tensorflow