CVE-2021-41199: TensorFlow-CPU - Integer Overflow in tf.image.resize

Background

TensorFlow is an open-source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-CPU is a specific package within TensorFlow that focuses on CPU-based computations. It is widely used in various industries and research domains for training and inference tasks. However, a vulnerability has been identified in TensorFlow-CPU that can lead to a process crash when the tf.image.resize function is called with a large input argument.

Vulnerability Detail

The vulnerability arises due to an integer overflow in the tf.image.resize function of TensorFlow-CPU. When this function is invoked with a large input argument, the number of elements in the output tensor exceeds the capacity of the int64_t type, causing an overflow. This overflow is detected by a CHECK statement, resulting in a process crash. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition by triggering the crash of a TensorFlow process. The vulnerability affects versions of TensorFlow-CPU up to and including 2.7.0rc0.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can avoid triggering the vulnerability by ensuring that the input argument provided to the tf.image.resize function is within a reasonable range. It is recommended to validate and sanitize user inputs before passing them to this function. Here is an example of how to perform input validation in Python:

import tensorflow as tf

def safe_resize(image, size):
    if size < 0 or size > 10000:
        raise ValueError('Invalid size')
    return tf.image.resize(image, size)

Conclusion

In conclusion, a vulnerability has been identified in TensorFlow-CPU that can result in a process crash when the tf.image.resize function is called with a large input argument. This vulnerability has been addressed in the latest versions of TensorFlow-CPU, and users are advised to update their installations to the fixed versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ