CVE-2021-37666: TensorFlow - Reference Binding to Null Pointer in tf.raw_ops.RaggedTensorToVariant

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been discovered in TensorFlow that allows an attacker to cause undefined behavior by binding a reference to a null pointer in the tf.raw_ops.RaggedTensorToVariant function.

Vulnerability Detail

The vulnerability arises from an incomplete validation of the splits values in the implementation of tf.raw_ops.RaggedTensorToVariant. The validation does not account for the case when the splits argument is empty. This oversight allows an attacker to pass a null pointer as the splits argument, leading to undefined behavior. The impact of this vulnerability can vary depending on the specific usage of TensorFlow in an application. However, it could potentially result in crashes, memory corruption, or other unpredictable behavior, which may be exploitable by an attacker.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can manually validate the splits argument before passing it to the tf.raw_ops.RaggedTensorToVariant function. This can be done by checking if the splits argument is empty and handling it appropriately in the application code. Here is an example of how to perform this validation in Python:

splits = [...]  # The splits argument

if splits:
    # Call tf.raw_ops.RaggedTensorToVariant with validated splits
    tf.raw_ops.RaggedTensorToVariant(splits)
else:
    # Handle empty splits case
    ...

Conclusion

In conclusion, TensorFlow versions 2.3.0 and above are vulnerable to a reference binding to null pointer vulnerability in the tf.raw_ops.RaggedTensorToVariant function. This vulnerability can lead to undefined behavior and potential exploitation by an attacker. Users should update their TensorFlow installations to one of the patched versions (2.6.0, 2.5.1, 2.4.3, or 2.3.4) to mitigate the risk. Additionally, a workaround is available for manually validating the splits argument. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ