`CHECK` fail in `AvgPoolGrad` in TensorFlow
Description
TensorFlow is an open source platform for machine learning. The implementation of AvgPoolGrad does not fully validate the input orig_input_shape. This results in a CHECK failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 2.7.2 | 2.7.2 |
tensorflowPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
tensorflowPyPI | >= 2.9.0, < 2.9.1 | 2.9.1 |
tensorflow-cpuPyPI | < 2.7.2 | 2.7.2 |
tensorflow-cpuPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
tensorflow-cpuPyPI | >= 2.9.0, < 2.9.1 | 2.9.1 |
tensorflow-gpuPyPI | < 2.7.2 | 2.7.2 |
tensorflow-gpuPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
tensorflow-gpuPyPI | >= 2.9.0, < 2.9.1 | 2.9.1 |
Affected products
1- Range: < 2.7.2
Patches
13a6ac52664c6Fix security vulnerability with AvgPoolGrad
2 files changed · +19 −3
tensorflow/core/kernels/avgpooling_op.cc+3 −3 modified@@ -298,7 +298,7 @@ class AvgPoolingGradOp : public OpKernel { TensorShape output_shape; auto shape_vec = tensor_in_shape.vec<int32>(); for (int64_t i = 0; i < tensor_in_shape.NumElements(); ++i) { - output_shape.AddDim(shape_vec(i)); + OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(shape_vec(i))); } const int64_t in_rows = output_shape.dim_size(1); const int64_t in_cols = output_shape.dim_size(2); @@ -457,7 +457,7 @@ class AvgPoolingGradOp<GPUDevice, T> : public OpKernel { TensorShape output_shape; auto shape_vec = tensor_in_shape.vec<int32>(); for (int64_t i = 0; i < tensor_in_shape.NumElements(); ++i) { - output_shape.AddDim(shape_vec(i)); + OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(shape_vec(i))); } if (output_shape.num_elements() == 0) { @@ -543,7 +543,7 @@ class AvgPoolingGradOpCustomGPUKernel : public OpKernel { TensorShape output_shape; auto shape_vec = tensor_in_shape.vec<int32>(); for (int64_t i = 0; i < tensor_in_shape.NumElements(); ++i) { - output_shape.AddDim(shape_vec(i)); + OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(shape_vec(i))); } if (output_shape.num_elements() == 0) { Tensor* output = nullptr;
tensorflow/python/kernel_tests/nn_ops/pooling_ops_test.py+16 −0 modified@@ -2470,6 +2470,22 @@ def testMaxPoolGradWithArgmaxEagerShapeErrors(self): inp, grad, argmax, ksize=[1, 1, 1, 1], strides=[1, 1, 1, 1], padding="VALID") + def testAvgPoolGradInvalidInputShapeRaiseError(self): + with self.assertRaises((ValueError, errors_impl.InvalidArgumentError)): + with self.cached_session(): + orig_input_shape = constant_op.constant( + -536870912, shape=[4], dtype=dtypes.int32) + grad = constant_op.constant( + .0890338004362538, shape=[1, 5, 7, 1], dtype=dtypes.float64) + t = gen_nn_ops.AvgPoolGrad( + orig_input_shape=orig_input_shape, + grad=grad, + ksize=[1, 2, 2, 1], + strides=[1, 2, 2, 1], + padding="VALID", + data_format="NHWC") + self.evaluate(t) + def GetMaxPoolFwdTest(input_size, filter_size, strides, padding):
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-2475-53vw-vp25ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-35968ghsaADVISORY
- github.com/tensorflow/tensorflow/commit/3a6ac52664c6c095aa2b114e742b0aa17fdce78fghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/releases/tag/v2.10.0ghsaWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-2475-53vw-vp25ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.