Executive brief
TensorFlow Lite is a machine learning framework used to run neural network models on mobile and embedded devices. A vulnerability in the pooling layer implementation allows attackers to craft specially malformed ML models that trigger a division-by-zero crash, causing denial of service to applications running those models.
Technical details
The vulnerability is a division-by-zero flaw (CWE-369) in TFLite's optimized pooling layer implementations. The root cause is that stride parameter validation is missing before the ComputePaddingHeightWidth function is called; an attacker can craft a model with stride_{height,width} set to zero, triggering the division by zero. The attack vector is local (model loading) with no authentication or network requirement—any application loading an untrusted TFLite model is vulnerable. Exploitation results in denial of service (application crash). Patches are available in TensorFlow 2.5.0 and backported to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
Affected products
- Google TensorFlow 0.x, 1.x, 2.0.0–2.0.4, 2.1.0–2.1.3, 2.2.0–2.2.2, 2.3.0–2.3.2, 2.4.0–2.4.1
- Google TensorFlow Lite < 2.5.0
Timeline
- 2021-05-13: disclosed: Advisory published
- 2021-05-21: patched: TensorFlow 2.5.0 released with fix; backports to 2.4.2, 2.3.3, 2.2.3, 2.1.4