CVE-2021-37647: TensorFlow-CPU - Null Pointer Dereference in SparseTensorSliceDataset

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow-CPU is a Python package that includes the CPU-only version of TensorFlow. It allows users to leverage the power of TensorFlow on systems without GPU support.

Vulnerability Detail

The vulnerability (CVE-2021-37647) exists in the tf.raw_ops.SparseTensorSliceDataset implementation of TensorFlow-CPU. When a user fails to supply valid arguments for a sparse tensor, the implementation can dereference a null pointer. Specifically, if the user provides empty indices while values are not empty, the code fails to handle this case and results in a null pointer dereference. This occurs when the code attempts to validate the indices by checking if they are monotonically increasing. As a result, an attacker could potentially exploit this vulnerability to cause a denial of service (null pointer dereference) or execute arbitrary code.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can ensure that both indices and values are provided for a sparse tensor. If either indices or values is empty, the vulnerability can be avoided. Here's an example of how to create a sparse tensor with non-empty indices and values:

import tensorflow as tf

indices = tf.constant([[0, 0], [1, 2]], dtype=tf.int64)
values = tf.constant([1, 2], dtype=tf.float32)
shape = tf.constant([3, 4], dtype=tf.int64)

sparse_tensor = tf.sparse.SparseTensor(indices, values, shape)

By ensuring that both indices and values are provided, the vulnerability can be mitigated.

Conclusion

The vulnerability (CVE-2021-37647) in TensorFlow-CPU's tf.raw_ops.SparseTensorSliceDataset implementation can lead to a null pointer dereference. This can result in a denial of service or potential execution of arbitrary code. Users are advised to update their TensorFlow-CPU package to one of the patched versions (TensorFlow 2.6.0, TensorFlow 2.5.1, TensorFlow 2.4.3, or TensorFlow 2.3.4) and ensure that both indices and values are provided for sparse tensors. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ