CVE-2021-41215: TensorFlow-GPU - Null Pointer Dereference in DeserializeSparse

Background

TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries for training and inference of deep learning models.

Vulnerability Detail

The vulnerability identified as CVE-2021-41215 affects TensorFlow-GPU. Specifically, the shape inference code for the DeserializeSparse function can trigger a null pointer dereference. This occurs because the shape inference function assumes that the serialize_sparse tensor is a tensor with positive rank and a last dimension of 3. However, if the tensor does not meet these criteria, a null pointer dereference can occur. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a temporary workaround, users can modify the shape inference code in their local installation of TensorFlow-GPU to handle tensors with varying ranks and dimensions. Here is an example of how the code can be modified:

# Original code
if tensor.rank > 0 and tensor.shape[-1] == 3:
    # Shape inference logic

# Modified code
if tensor.rank > 0:
    if tensor.shape[-1] == 3:
        # Shape inference logic
    else:
        # Handle tensors with dimensions other than 3
else:
    # Handle tensors with rank 0

Please note that this is a temporary workaround and it is strongly recommended to apply the official patches by upgrading to the fixed versions of TensorFlow-GPU.

Conclusion

In conclusion, the vulnerability CVE-2021-41215 in TensorFlow-GPU can lead to a null pointer dereference in the shape inference code for DeserializeSparse. It is crucial to upgrade to the fixed versions (2.7.0, 2.6.1, 2.5.2, or 2.4.4) or apply the temporary workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ