CVE-2021-41195: TensorFlow GPU - Denial of Service Vulnerability

Background

TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation. It allows users to train and run machine learning models on GPU hardware, enabling faster and more efficient processing of large datasets. However, a vulnerability has been discovered in TensorFlow GPU that can lead to a denial of service (DoS) attack.

Vulnerability Detail

The vulnerability (CVE-2021-41195) in TensorFlow GPU is related to the implementation of tf.math.segment_* operations. When a large segment id is provided in the segment_ids parameter, it triggers a CHECK-fail related abort, resulting in a DoS condition. This vulnerability is similar to other reported vulnerabilities in TensorFlow that are localized to specific APIs. The issue arises when the implementation computes the output shape using AddDim, which can cause a CHECK failure and lead to a std::abort if the number of elements in the tensor overflows an int64_t value. The impact of this vulnerability is the disruption of service and potential resource exhaustion on systems running TensorFlow GPU. The fix for this vulnerability will be included in TensorFlow 2.7.0, and patches will also be provided for earlier versions.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a temporary workaround, users can modify the affected code to use AddDimWithStatus instead of AddDim when computing the output shape. This can prevent the CHECK failure and avoid the DoS condition. Here is an example of how the code can be modified:

import tensorflow as tf

# Original code
output_shape = tf.shape(input_tensor)

# Modified code
output_shape = tf.raw_ops.AddDimWithStatus(input=input_tensor, dim=0)

It is important to note that this workaround is not a permanent solution and should be replaced with the official fix as soon as it is available.

Conclusion

The vulnerability in TensorFlow GPU (CVE-2021-41195) can lead to a denial of service (DoS) condition, impacting the availability of services relying on TensorFlow GPU. It is crucial for users to update to the fixed versions or apply the provided patches as soon as they become available. Monitoring the official TensorFlow website and GitHub repository for updates is recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ