VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 5, 2021· Updated Aug 4, 2024

Overflow/crash in `tf.tile` when tiling tensor is large

CVE-2021-41198

Description

TensorFlow is an open source platform for machine learning. In affected versions if tf.tile is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow. The number of elements in the output tensor is too much for the int64_t type and the overflow is detected via a CHECK statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
>= 2.6.0, < 2.6.12.6.1
tensorflowPyPI
>= 2.5.0, < 2.5.22.5.2
tensorflowPyPI
< 2.4.42.4.4
tensorflow-cpuPyPI
>= 2.6.0, < 2.6.12.6.1
tensorflow-cpuPyPI
>= 2.5.0, < 2.5.22.5.2
tensorflow-cpuPyPI
< 2.4.42.4.4
tensorflow-gpuPyPI
>= 2.6.0, < 2.6.12.6.1
tensorflow-gpuPyPI
>= 2.5.0, < 2.5.22.5.2
tensorflow-gpuPyPI
< 2.4.42.4.4

Affected products

1

Patches

1
9294094df6fe

Merge pull request #51138 from yongtang:46911-tile

https://github.com/tensorflow/tensorflowTensorFlower GardenerSep 21, 2021via ghsa
commit
2 files changed · +13 −1
  • tensorflow/core/kernels/tile_ops.cc+2 −1 modified
    @@ -188,7 +188,8 @@ class TileOp : public OpKernel {
           context, multiples_array[i] >= 0,
           errors::InvalidArgument("Expected multiples[", i, "] >= 0, but got ",
                                   multiples_array[i]));
-      output_shape.AddDim(input.dim_size(i) * multiples_array[i]);
+      OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(
+                                  input.dim_size(i) * multiples_array[i]));
     }
     if (output_shape == input.shape()) {
       context->set_output(0, input);
  • tensorflow/python/kernel_tests/shape_ops_test.py+11 −0 modified
    @@ -723,6 +723,17 @@ def testShapeFunctionEdgeCases(self):
           inp, array_ops.placeholder(
               dtypes.int32, shape=[3]))
 
+  def testLargeTensor(self):
+    # Test case for GItHub issue 46911.
+    if test_util.is_xla_enabled():
+      # The following test fails with XLA enabled.
+      return
+    with self.assertRaises(errors_impl.InternalError):
+      with self.cached_session():
+        tiled = array_ops.tile(
+            np.ones((1, 1, 1)), [100000000, 100000000, 100000000])
+        self.evaluate(tiled)
+
 
 if __name__ == "__main__":
   test.main()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.