CVE-2021-37659: TensorFlow CPU - Null Pointer Dereference in Binary Cwise Operations

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. The TensorFlow CPU package, available on PyPI, is a specific distribution of TensorFlow optimized for CPU-based systems.

Vulnerability Detail

The vulnerability identified as CVE-2021-37659 affects the TensorFlow CPU package. It arises from a flaw in the implementation of binary cwise operations, specifically when computing gradients. The implementation assumes that the two input tensors have the same number of elements but fails to validate this condition. As a result, when the eigen functor executes, it triggers out-of-bounds heap reads and undefined behavior by binding to a null pointer. This vulnerability can be exploited by an attacker to cause undefined behavior and potentially lead to a denial-of-service (DoS) condition or arbitrary code execution.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can manually validate the sizes of the input tensors before performing binary cwise operations. This can be achieved by comparing the shapes or dimensions of the tensors and ensuring they have the same number of elements. Here's an example code snippet demonstrating the workaround:

import tensorflow as tf

def safe_binary_cwise_op(a, b):
    if tf.size(a) != tf.size(b):
        raise ValueError('Input tensors must have the same number of elements')
    return tf.add(a, b)

By explicitly checking the sizes, the risk of triggering the null pointer dereference is mitigated.

Conclusion

In conclusion, the CVE-2021-37659 vulnerability in the TensorFlow CPU package exposes a null pointer dereference issue in binary cwise operations. This flaw can be exploited by an attacker to cause undefined behavior and potentially lead to a DoS condition or arbitrary code execution. The TensorFlow development team has addressed this vulnerability with patches in specific versions of TensorFlow. Users are advised to update their TensorFlow CPU package and implement the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ