Executive brief
TensorFlow is a machine learning framework that provides operations for building and training neural networks. The QuantizedReshape operation in TensorFlow contains a heap buffer overflow vulnerability that can be triggered by passing empty tensor thresholds, allowing an attacker to read or corrupt memory and potentially crash the application or execute arbitrary code.
Technical details
The vulnerability is a heap buffer overflow (CWE-787) in the QuantizedReshape operation implementation. The root cause is that the code assumes input_min and input_max tensor parameters are always valid scalars and directly accesses the first element via .flat<float>()(0) without validating the tensor is non-empty. When an empty tensor is passed, this out-of-bounds memory access occurs. Attack precondition is that an attacker can invoke tf.raw_ops.QuantizedReshape with malicious inputs—this requires local code execution or ability to run TensorFlow code. The patch was merged in commit a324ac84e573fba362a5e53d4e74d5de6729933e and released in TensorFlow 2.5.0, with backports to 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
Affected products
- Google TensorFlow before 2.1.4, 2.2.0-2.2.2, 2.3.0-2.3.2, 2.4.0-2.4.1
- Google TensorFlow CPU before 2.1.4, 2.2.0-2.2.2, 2.3.0-2.3.2, 2.4.0-2.4.1
- Google TensorFlow GPU before 2.1.4, 2.2.0-2.2.2, 2.3.0-2.3.2, 2.4.0-2.4.1
Timeline
- 2021-05-21: disclosed
- 2021-05-21: patched: TensorFlow 2.5.0 and backports to 2.1.4, 2.2.3, 2.3.3, 2.4.2