CVE-2021-37666: TensorFlow GPU - Null Pointer Dereference in tf.raw_ops.RaggedTensorToVariant

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a specific package that enables GPU acceleration for TensorFlow computations. It allows users to leverage the power of GPUs to accelerate training and inference processes in machine learning models.

Vulnerability Detail

In affected versions of TensorFlow GPU, there is a vulnerability in the tf.raw_ops.RaggedTensorToVariant function that can lead to undefined behavior. An attacker can exploit this vulnerability by binding a reference to a null pointer. The implementation of the function lacks proper validation of the splits values, specifically missing the case when the argument would be empty. This oversight allows an attacker to trigger undefined behavior, potentially leading to crashes, memory corruption, or other unintended consequences. The vulnerability has been assigned the identifier CVE-2021-37666.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a workaround, users can manually validate the splits values before passing them to the tf.raw_ops.RaggedTensorToVariant function. By ensuring that the splits are not empty, the vulnerability can be mitigated. Here is an example code snippet that demonstrates the workaround:

splits = ...  # User-defined splits

if len(splits) > 0:
    tf.raw_ops.RaggedTensorToVariant(splits)
else:
    # Handle empty splits case
    ...

Conclusion

In conclusion, the vulnerability CVE-2021-37666 in TensorFlow GPU exposes users to the risk of undefined behavior due to a null pointer dereference in the tf.raw_ops.RaggedTensorToVariant function. To mitigate this vulnerability, it is crucial to update to the patched versions of TensorFlow GPU and ensure proper validation of splits values. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ