CVE-2021-29568: TensorFlow ParameterizedTruncatedNormal Null Pointer Dereference

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been discovered in TensorFlow that can lead to undefined behavior when binding to a null pointer in the tf.raw_ops.ParameterizedTruncatedNormal function.

Vulnerability Detail

The vulnerability arises due to a lack of input argument validation in the implementation of tf.raw_ops.ParameterizedTruncatedNormal. Specifically, the vulnerability occurs when the shape argument is empty, resulting in shape_tensor.flat<T>() being an empty array. This leads to undefined behavior when the implementation attempts to access the first element of shape. An attacker can exploit this vulnerability to trigger unexpected behavior or potentially cause a denial-of-service condition. The vulnerability affects versions of TensorFlow up to 2.4.3.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a temporary workaround, users can manually validate the shape argument before calling the tf.raw_ops.ParameterizedTruncatedNormal function. This can be done by checking if the shape array is empty and taking appropriate action, such as providing a default shape or raising an error. Here is an example of how to perform this validation in Python:

import tensorflow as tf

def parameterized_truncated_normal(shape, mean, stddev):
    if not shape:
        raise ValueError('Shape argument cannot be empty.')
    return tf.raw_ops.ParameterizedTruncatedNormal(shape=shape, mean=mean, stddev=stddev)

By implementing this workaround, users can prevent the null pointer dereference vulnerability.

Conclusion

The discovered vulnerability in TensorFlow's tf.raw_ops.ParameterizedTruncatedNormal function can lead to undefined behavior and potential security risks. Users are strongly advised to update their TensorFlow installations to the fixed versions mentioned above or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ