CVE-2021-29564: TensorFlow EditDistance Null Pointer Dereference

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. The vulnerability described here affects the TensorFlow package, specifically the implementation of tf.raw_ops.EditDistance.

Vulnerability Detail

The vulnerability in TensorFlow arises from incomplete validation of input parameters in the implementation of tf.raw_ops.EditDistance. An attacker can exploit this flaw to trigger a null pointer dereference, leading to a crash or potentially allowing the execution of arbitrary code. The vulnerability has been assigned the CVE identifier CVE-2021-29564 and is also tracked as GHSA-75f6-78jr-4656. It was discovered by the PySEC team and reported on May 14, 2021. The issue has been addressed in TensorFlow 2.5.0, and patches have been backported to versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can avoid using the vulnerable functionality (tf.raw_ops.EditDistance) until the package is updated or patched. If the functionality is critical and cannot be avoided, it is recommended to implement additional input validation and sanitization measures to mitigate the risk of exploitation. Here is an example of how to perform input validation for the tf.raw_ops.EditDistance function:

import tensorflow as tf

def validate_edit_distance(inputs):
    if inputs is None:
        raise ValueError('Invalid input: inputs cannot be None.')
    # Perform additional validation checks
    ...
    # Call the vulnerable function
    tf.raw_ops.EditDistance(inputs=inputs)

Conclusion

In conclusion, the vulnerability in TensorFlow's tf.raw_ops.EditDistance function can be exploited to trigger a null pointer dereference, potentially leading to a crash or arbitrary code execution. Users are advised to update to TensorFlow 2.5.0 or apply the appropriate patches for the affected versions. Workarounds include avoiding the use of the vulnerable functionality and implementing additional input validation measures. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ