Executive brief
TensorFlow is an open-source machine learning framework used to build and deploy AI models. The BandedTriangularSolve operation contains a heap buffer overflow vulnerability that can be triggered by providing empty tensor inputs. An attacker with local access and permissions to run TensorFlow code could exploit this to crash the application or potentially execute arbitrary code, impacting the availability and integrity of ML workloads.
Technical details
The vulnerability is a heap buffer overflow (CWE-120, CWE-787) in the Eigen-based implementation of tf.raw_ops.BandedTriangularSolve. The root cause is inadequate input validation: while the ValidateInputTensors function checks tensor dimensions, it fails to validate that tensors are non-empty. Additionally, OP_REQUIRES macro failures in helper functions are not properly checked by the caller before continuing execution. An attacker can trigger the overflow by calling BandedTriangularSolve with empty tensor inputs, causing out-of-bounds memory access. The attack requires local access and ability to execute TensorFlow Python code. Patches are available in versions 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0.
Affected products
- Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
- Google TensorFlow CPU 1.15.0, 2.1.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
- Google TensorFlow GPU 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
Timeline
- 2021-05-13: disclosed: Vulnerability published by TensorFlow team
- 2021-05: patched: Patches available in TensorFlow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0