Executive brief
TensorFlow is a machine learning framework used for building and training AI models. A flaw in the ResourceGather operation allows an attacker to read data outside allocated memory boundaries or trigger a crash, potentially leading to information disclosure or service disruption in applications using affected TensorFlow versions.
Technical details
The vulnerability is a heap out-of-bounds (OOB) read in the ResourceGather operation caused by missing validation of the batch_dims parameter against the input tensor rank. The vulnerable code uses batch_dims to iterate over tensor dimensions without checking that batch_dims ≤ tensor.dims(), causing reads beyond valid heap memory. In debug builds, a DCHECK catches the out-of-bounds access; in release builds, the DCHECK becomes a no-op, allowing the OOB read to proceed. The attack requires calling tf.raw_ops.ResourceGather with a batch_dims value exceeding the input tensor's rank. Patches are available in TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0.
Affected products
- Google TensorFlow before 2.3.4; 2.4.0-2.4.2; 2.5.0
- Google TensorFlow CPU before 2.3.4; 2.4.0-2.4.2; 2.5.0
- Google TensorFlow GPU before 2.3.4; 2.4.0-2.4.2; 2.5.0
Timeline
- 2021-08-11: disclosed
- 2021-08-25: patched: TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0 released with fix