CVE-2021-37653: TensorFlow ResourceGather Floating Point Exception

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. It allows developers to create and train machine learning models using high-level APIs and provides efficient execution on a variety of hardware platforms. However, a vulnerability has been discovered in TensorFlow that can lead to a crash when certain operations are performed on a resource variable.

Vulnerability Detail

The vulnerability (CVE-2021-37653) in TensorFlow arises from a floating point exception in the tf.raw_ops.ResourceGather function. The implementation of this function fails to check if the value of a variable, batch_size, is zero before dividing by it. This can trigger a floating point exception and result in a crash. An attacker can exploit this vulnerability by providing a malicious input that triggers the problematic code path. The impact of this vulnerability is a denial of service (DoS) condition, as it causes the TensorFlow application to crash. This can disrupt the normal operation of the machine learning system and potentially lead to data loss or other adverse effects.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can manually modify the affected code in their TensorFlow installation to include the necessary check for zero batch_size before performing the division. Here is an example of the modified code:

# Original code
batch_size = compute_batch_size()
result = tf.raw_ops.ResourceGather(resource, indices, batch_size)

# Modified code
batch_size = compute_batch_size()
if batch_size != 0:
    result = tf.raw_ops.ResourceGather(resource, indices, batch_size)
else:
    result = None

Conclusion

The vulnerability (CVE-2021-37653) in TensorFlow's tf.raw_ops.ResourceGather function can be exploited to trigger a floating point exception and crash the TensorFlow application. To mitigate this vulnerability, users should update their TensorFlow installations to one of the patched versions. Alternatively, a workaround is available by modifying the affected code to include a check for zero batch_size before performing the division. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ