PT-2026-59906 · Pypi · Tensorflow-Cpu
Published
2026-07-13
·
Updated
2026-07-13
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Impact
When [
mlir::tfg::TFOp::nameAttr](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/graphdef import.cc) receives null type list attributes, it crashes.cpp
StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
const OpDef::ArgDef &arg def,
SmallVectorImpl<Type> &types) {
// Check whether a type list attribute is specified.
if (!arg def.type list attr().empty()) {
if (auto v = attrs.get(arg def.type list attr()).dyn cast<ArrayAttr>()) {
for (Attribute attr : v) {
if (auto dtype = attr.dyn cast<TypeAttr>()) {
types.push back(UnrankedTensorType::get(dtype.getValue()));
} else {
return InvalidArgument("Expected '", arg def.type list attr(),
"' to be a list of types");
}
}
return v.size();
}
return NotFound("Type attr not found: ", arg def.type list attr());
}
unsigned num = 1;
// Check whether a number attribute is specified.
if (!arg def.number attr().empty()) {
if (auto v = attrs.get(arg def.number attr()).dyn cast<IntegerAttr>()) {
num = v.getValue().getZExtValue();
} else {
return NotFound("Type attr not found: ", arg def.number attr());
}
}
// Check for a type or type attribute.
Type dtype;
if (arg def.type() != DataType::DT INVALID) {
TF RETURN IF ERROR(ConvertDataType(arg def.type(), b , &dtype));
} else if (arg def.type attr().empty()) {
return InvalidArgument("Arg '", arg def.name(),
"' has invalid type and no type attribute");
} else {
if (auto v = attrs.get(arg def.type attr()).dyn cast<TypeAttr>()) {
dtype = v.getValue();
} else {
return NotFound("Type attr not found: ", arg def.type attr());
}
}
types.append(num, UnrankedTensorType::get(dtype));
return num;
}Patches
We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21c9270930457095092f558fbad4c03e5.
The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tensorflow-Cpu