CVE-2021-37678: Arbitrary code execution due to YAML deserialization in TensorFlow

Background

TensorFlow is an open-source machine learning framework that is widely used for developing and training deep learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning applications. TensorFlow includes a module called Keras, which is a high-level neural networks API. Keras allows users to define and train deep learning models using a simple and intuitive interface. However, a vulnerability has been discovered in TensorFlow and Keras that can lead to arbitrary code execution when deserializing a Keras model from YAML format.

Vulnerability Detail

The vulnerability in TensorFlow and Keras arises from the use of yaml.unsafe_load when deserializing a Keras model from YAML format. An attacker can craft a malicious YAML payload that, when deserialized, can execute arbitrary code on the system. This can lead to various security risks, including unauthorized access, data leakage, and remote code execution. The impact of this vulnerability is critical, with a CVSS score of 9.3.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can avoid using YAML format for serializing and deserializing Keras models in TensorFlow. Instead, alternative serialization formats like JSON can be used. Here is an example of serializing and deserializing a Keras model using JSON:

from tensorflow.keras import models
import json

model = models.Sequential()
# Build and compile the model

# Serialize the model to JSON
model_json = model.to_json()

# Save the JSON to a file
with open('model.json', 'w') as json_file:
    json_file.write(model_json)

# Load the JSON from the file
with open('model.json', 'r') as json_file:
    loaded_model_json = json_file.read()

# Deserialize the JSON to a model
loaded_model = models.model_from_json(loaded_model_json)

By using JSON instead of YAML, the vulnerability can be mitigated.

Conclusion

The vulnerability in TensorFlow and Keras that allows for arbitrary code execution when deserializing Keras models from YAML format has been addressed by the TensorFlow team. Users are advised to update their TensorFlow installations to the patched versions and avoid using YAML format for serialization and deserialization. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ