CVE-2021-37638: TensorFlow GPU - Null Pointer Dereference in tf.raw_ops.RaggedTensorToTensor

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for training and inference of machine learning models.

Vulnerability Detail

The vulnerability (CVE-2021-37638) in TensorFlow GPU arises from an issue in the tf.raw_ops.RaggedTensorToTensor API. When an invalid argument is provided for the row_partition_types parameter, it leads to a null pointer dereference and triggers undefined behavior. The vulnerable implementation accesses the first element of a user-supplied list without validating if the list is empty. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a temporary workaround, users can manually validate the row_partition_types list before passing it to the RaggedTensorToTensor API. Here's an example of how to perform the validation in Python:

if row_partition_types:
    # Call the vulnerable API
    tf.raw_ops.RaggedTensorToTensor(row_partition_types=row_partition_types)
else:
    # Handle the empty list case
    print('Error: row_partition_types list is empty')

Conclusion

In conclusion, the vulnerability (CVE-2021-37638) in TensorFlow GPU can be mitigated by updating to the patched versions or applying the provided workaround. It is crucial to promptly address this vulnerability to prevent potential exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ