CVE-2021-29585: TensorFlow CPU - Padding Computation Vulnerability

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow CPU is a specific package within TensorFlow that focuses on running TensorFlow computations on CPUs. This package is widely used in various machine learning applications and frameworks.

Vulnerability Detail

The vulnerability (CVE-2021-29585) exists in the TFLite computation for size of output after padding in TensorFlow CPU. The ComputeOutSize function, responsible for calculating the output size after padding, does not validate the stride argument before performing division. This oversight allows users to create malicious models that trigger a call to ComputeOutSize with a stride value of 0. As a result, a division by zero error occurs, leading to potential crashes, unexpected behavior, or even remote code execution. The vulnerability affects versions of TensorFlow CPU up to and including 2.4.3.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can manually validate the stride argument before calling the ComputeOutSize function. By ensuring that the stride value is not 0, the vulnerability can be mitigated. Here's an example of how to perform the validation in Python:

stride = ...  # The stride value
if stride != 0:
    output_size = ComputeOutSize(...)
else:
    # Handle the case when stride is 0
    ...

Conclusion

The padding computation vulnerability in TensorFlow CPU (CVE-2021-29585) poses a risk of crashes, unexpected behavior, or remote code execution. It is crucial for users to update their TensorFlow CPU installations to the latest patched version or apply the backported fixes to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ