Executive brief
TensorFlow is a widely-used machine learning framework for building and training neural networks. An attacker can crash any TensorFlow application by calling the MapStage operation with malformed inputs, causing the application to terminate abnormally. This could disrupt machine learning services or batch processing pipelines that rely on TensorFlow.
Technical details
The vulnerability exists in tf.raw_ops.MapStage, which fails to validate that the key input is a valid non-empty tensor. When called with an empty tensor (shape [0, 0, 0, 0]), the operation triggers a CHECK failure that terminates the process. This is an input validation weakness (CWE-20). The attack requires no authentication and can be triggered by any code with access to TensorFlow APIs, making it exploitable via local execution or remote code execution if the application exposes TensorFlow operations. The fix adds proper input validation and was patched in TensorFlow 2.6.0, with backports to 2.5.1, 2.4.3, and 2.3.4.
Affected products
- Google TensorFlow 0.12.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0
- Google TensorFlow CPU 1.15.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0
- Google TensorFlow GPU 0.12.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0
Timeline
- 2021-08-11: disclosed
- 2021-08-25: patched: Patches released for TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0