CVE-2021-37678: TensorFlow Keras Model YAML Deserialization Arbitrary Code Execution

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow includes a high-level API called Keras, which simplifies the process of building and training deep learning models. Keras models can be serialized and deserialized using various formats, including YAML. However, a vulnerability in the deserialization process of Keras models from YAML format allows for arbitrary code execution.

Vulnerability Detail

The vulnerability (CVE-2021-37678) arises from the usage of yaml.unsafe_load in the implementation of deserializing Keras models from YAML format. This function can execute arbitrary code provided as input, leading to potential remote code execution. An attacker could craft a malicious YAML file that, when deserialized, triggers the execution of arbitrary code on the target system. This could result in unauthorized access, data leakage, or further compromise of the affected machine. The vulnerability affects TensorFlow versions 2.3.0 to 2.5.0, as well as the tensorflow-cpu package on PyPI.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a temporary workaround, users can switch to alternative serialization formats, such as JSON, until the patched versions of TensorFlow are released. Here is an example of how to serialize and deserialize a Keras model using JSON:

import json

# Serialize the Keras model to JSON
model_json = model.to_json()

# Save the JSON to a file
with open('model.json', 'w') as json_file:
    json_file.write(model_json)

# Load the JSON from a file
with open('model.json', 'r') as json_file:
    loaded_model_json = json_file.read()

# Deserialize the JSON to a Keras model
loaded_model = tf.keras.models.model_from_json(loaded_model_json)

Conclusion

The vulnerability (CVE-2021-37678) in TensorFlow and Keras models allows for arbitrary code execution when deserializing Keras models from YAML format. This can lead to unauthorized access, data leakage, or further compromise of the affected system. It is crucial to update to the patched versions of TensorFlow and avoid deserializing models from untrusted sources. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ