Executive brief
TensorFlow Lite is a machine learning inference engine used to run neural network models on mobile and embedded devices. A flaw in the Minimum and Maximum operators allows an attacker to read data from outside the bounds of allocated memory when processing empty input tensors, potentially exposing sensitive information from adjacent memory regions.
Technical details
A heap out-of-bounds (OOB) read vulnerability exists in TensorFlow Lite's broadcasting implementation for the Minimum and Maximum operators (CWE-125). The vulnerability occurs when either of the two input tensors is empty; the broadcasting logic uses the same index to read from both input tensors without validating that the index is within bounds. An attacker can craft a model with empty tensor inputs to trigger an out-of-bounds memory read. No authentication or network access is required—only the ability to provide a malicious model to the inference engine. The vulnerability has been patched in TensorFlow 2.5.0, with backports to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
Affected products
- Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
- Google TensorFlow Lite before 2.5.0
Timeline
- 2021-05-13: disclosed
- 2021-05-21: advisory
- 2021-05-21: patched: Patches released in TensorFlow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0