VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Sep 16, 2022· Updated Apr 23, 2025

Null dereference on MLIR on empty function attributes in TensorFlow

CVE-2022-36000

Description

TensorFlow is an open source platform for machine learning. When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit aed36912609fc07229b4d0a7b44f3f48efc00fd0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.7.22.7.2
tensorflowPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflowPyPI
>= 2.9.0, < 2.9.12.9.1
tensorflow-cpuPyPI
< 2.7.22.7.2
tensorflow-cpuPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-cpuPyPI
>= 2.9.0, < 2.9.12.9.1
tensorflow-gpuPyPI
< 2.7.22.7.2
tensorflow-gpuPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-gpuPyPI
>= 2.9.0, < 2.9.12.9.1

Affected products

1

Patches

1
aed36912609f

Check correct input/output scalar types for LinearAlgebraOp.

https://github.com/tensorflow/tensorflowAntonio SanchezJul 18, 2022via ghsa
commit
2 files changed · +24 −0
  • tensorflow/core/kernels/linalg/linalg_ops_common.cc+12 −0 modified
    @@ -15,14 +15,17 @@ limitations under the License.
 
 #include "tensorflow/core/kernels/linalg/linalg_ops_common.h"
 
+#include <initializer_list>
 #include <utility>
 
 #include "third_party/eigen3/Eigen/Core"
 #include "tensorflow/core/framework/device_base.h"
 #include "tensorflow/core/framework/kernel_def_builder.h"
 #include "tensorflow/core/framework/op_kernel.h"
 #include "tensorflow/core/framework/tensor_shape.h"
+#include "tensorflow/core/framework/types.h"
 #include "tensorflow/core/lib/core/errors.h"
+#include "tensorflow/core/platform/errors.h"
 #include "tensorflow/core/platform/logging.h"
 #include "tensorflow/core/platform/types.h"
 
@@ -152,6 +155,10 @@ void LinearAlgebraOp<InputScalar, OutputScalar>::AnalyzeInputs(
     input_matrix_shapes->emplace_back(
         std::initializer_list<int64_t>({num_rows, num_cols}));
     inputs->emplace_back(&in);
+    OP_REQUIRES(
+        context, in.dtype() == DataTypeToEnum<InputScalar>::v(),
+        errors::InvalidArgument("Invalid input dtype ", in.dtype(), " vs ",
+                                DataTypeToEnum<InputScalar>::v()));
   }
   // Have the derived class validate that the inputs are as expected.
   ValidateInputMatrixShapes(context, *input_matrix_shapes);
@@ -212,6 +219,11 @@ void LinearAlgebraOp<InputScalar, OutputScalar>::PrepareOutputs(
       OP_REQUIRES_OK(context, context->allocate_output(
                                   output_idx, output_tensor_shape, &out));
     }
+    OP_REQUIRES(
+        context, out->dtype() == DataTypeToEnum<OutputScalar>::v(),
+        errors::InvalidArgument("Invalid output dtype ", out->dtype(), " vs ",
+                                DataTypeToEnum<OutputScalar>::v()));
+
     outputs->emplace_back(out);
   }
 }
  • tensorflow/python/kernel_tests/linalg/eig_op_test.py+12 −0 modified
    @@ -18,8 +18,10 @@
 
 from tensorflow.python.framework import constant_op
 from tensorflow.python.framework import dtypes as dtypes_lib
+from tensorflow.python.framework import errors
 from tensorflow.python.framework import test_util
 from tensorflow.python.ops import array_ops
+from tensorflow.python.ops import gen_linalg_ops
 from tensorflow.python.ops import gradient_checker_v2
 from tensorflow.python.ops import linalg_ops
 from tensorflow.python.ops import math_ops
@@ -88,6 +90,16 @@ def testMatrixThatFailsWhenFlushingDenormsToZero(self):
       self.assertAllClose(matrix,
                           np.matmul(np.matmul(v, np.diag(e)), v.transpose()))
 
+  def testMismatchedDtypes(self):
+    tensor = constant_op.constant([[0, 1], [2, 3]], dtype=dtypes_lib.float32)
+    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
+                                "Invalid output dtype"):
+      self.evaluate(
+          gen_linalg_ops.eig(
+              input=tensor,
+              Tout=dtypes_lib.complex128,  # Expected dtype: complex64.
+              compute_v=True))
+
 
 def SortEigenValues(e):
   perm = np.argsort(e.real + e.imag, -1)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.