Executive brief
TensorFlow's TensorListReserve operation fails to validate the num_elements parameter, allowing an attacker to pass a negative value that causes the runtime to crash. This denial-of-service vulnerability affects machine learning pipelines using TensorFlow, potentially disrupting model training, inference, or data processing workloads.
Technical details
The tf.raw_ops.TensorListReserve operation in TensorFlow performs an unchecked std::vector.resize() call with a user-supplied num_elements parameter. An attacker providing a negative value triggers an abort condition in the C++ standard library. The vulnerability exists in versions prior to 2.6.0 (with cherry-picked fixes in 2.3.4, 2.4.3, and 2.5.1). Exploitation requires the ability to invoke TensorFlow operations with attacker-controlled input (local access or remote code execution capability in the application layer). The impact is a process crash (denial of service).
Affected products
- Google TensorFlow < 2.6.0; fixed in 2.3.4, 2.4.3, 2.5.1, 2.6.0+
- Google TensorFlow CPU < 2.3.4, 2.4.0–2.4.2, 2.5.0
- Google TensorFlow GPU < 2.3.4, 2.4.0–2.4.2, 2.5.0
Timeline
- 2021-08-11: disclosed
- 2021-08-25: patched: Fix included in TensorFlow 2.6.0 and cherry-picked to 2.3.4, 2.4.3, 2.5.1