CVE-2021-41201: TensorFlow GPU - Uninitialized Variable Access in EinsumHelper::ParseEquation()

Background

TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a specific package that enables GPU acceleration for TensorFlow. It allows users to leverage the power of GPUs to accelerate machine learning computations, resulting in faster training and inference times.

Vulnerability Detail

The vulnerability (CVE-2021-41201) exists in TensorFlow GPU versions prior to 2.7.0. During execution, the EinsumHelper::ParseEquation() function is responsible for setting flags in the input_has_ellipsis vector and *output_has_ellipsis boolean to indicate the presence of ellipsis in the corresponding inputs and output. However, the code only sets these flags to true and never assigns them false. This leads to uninitialized variable access if callers assume that EinsumHelper::ParseEquation() always sets these flags. An attacker could potentially exploit this vulnerability to access uninitialized memory, which may result in information disclosure or arbitrary code execution.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a temporary workaround, users can avoid using the EinsumHelper::ParseEquation() function or modify their code to handle the uninitialized variable access appropriately. Here is an example of how the code can be modified to handle the issue:

# Original code
equation = EinsumHelper.ParseEquation()

# Modified code
equation = EinsumHelper.ParseEquation()
if equation.input_has_ellipsis is None:
    equation.input_has_ellipsis = []
if equation.output_has_ellipsis is None:
    equation.output_has_ellipsis = False

Conclusion

In conclusion, the vulnerability (CVE-2021-41201) in TensorFlow GPU versions prior to 2.7.0 allows for uninitialized variable access in the EinsumHelper::ParseEquation() function. This can potentially lead to information disclosure or arbitrary code execution. Users are strongly advised to update their TensorFlow GPU installations to the latest patched version as soon as it becomes available. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ