Executive brief
TensorFlow's DrawBoundingBoxes operation (used to render bounding boxes on images) crashes when given malformed input such as an empty image. An attacker can craft a simple Python script to trigger this crash, causing a denial of service that disrupts any application relying on this image processing function. The crash occurs due to improper input validation rather than a security bypass, so the impact is service availability rather than data theft.
Technical details
The vulnerability is a CHECK-fail (improper error handling) in the DrawBoundingBoxes operation. The root cause is that the implementation uses CHECK_* assertions instead of OP_REQUIRES macros to validate user-controlled inputs. When an attacker passes an image with zero height, the code calculates max_box_row_clamp as negative, triggering CHECK_GE(max_box_row_clamp, 0) and crashing the process. The attack vector is local/network depending on how TensorFlow is deployed (e.g., a model serving API); no authentication is required, and an attacker needs only to invoke the operation with crafted tensor dimensions. Patches are available in TensorFlow 2.5.0 and cherry-picked releases 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
Affected products
- Google TensorFlow versions prior to 2.1.4; 2.2.0–2.2.2; 2.3.0–2.3.2; 2.4.0–2.4.1
- Google TensorFlow CPU versions prior to 2.1.4; 2.2.0–2.2.2; 2.3.0–2.3.2; 2.4.0–2.4.1
- Google TensorFlow GPU versions prior to 2.1.4; 2.2.0–2.2.2; 2.3.0–2.3.2; 2.4.0–2.4.1
Timeline
- 2021-05-13: disclosed
- 2021-05-21: advisory
- 2021-05-21: patched: Patches released in TensorFlow 2.5.0 and cherry-picked to 2.4.2, 2.3.3, 2.2.3, 2.1.4