CVE-2021-29563: TensorFlow RFFT CHECK-fail Vulnerability

Background

TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow includes a module called tf.raw_ops.RFFT which performs the fast Fourier transform on input data. This module is used in various applications for signal processing and image analysis. However, a vulnerability has been discovered in the implementation of tf.raw_ops.RFFT that can lead to a denial of service (DoS) attack.

Vulnerability Detail

The vulnerability, identified as CVE-2021-29563, arises from a CHECK-failure in the tf.raw_ops.RFFT function. An attacker can exploit this vulnerability by providing specific input values that cause the Eigen code to operate on an empty matrix. This triggers an assertion and results in the termination of the program. The impact of this vulnerability is a DoS condition, where the affected TensorFlow application becomes unresponsive and fails to perform the expected computations.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can validate the input data before passing it to the tf.raw_ops.RFFT function. By ensuring that the input data is not empty or invalid, the vulnerability can be mitigated. Here is an example of how to perform input validation in Python:

import tensorflow as tf

inputs = tf.constant([1], shape=[1], dtype=tf.float32)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)

if inputs.shape[0] > 0 and fft_length.shape[0] > 0:
    tf.raw_ops.RFFT(input=inputs, fft_length=fft_length)
else:
    print('Invalid input data')

By checking the shape of the input tensors, the vulnerability can be avoided.

Conclusion

The TensorFlow RFFT CHECK-fail vulnerability (CVE-2021-29563) can lead to a denial of service (DoS) attack in TensorFlow applications. It is crucial to update to the patched versions of TensorFlow or apply input validation as a workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ