Executive brief
TensorFlow is a machine learning library that includes TFLite, a lightweight runtime for deploying neural networks. An attacker can craft a specially designed model that triggers a division-by-zero crash in the LSH (Locality Sensitive Hashing) implementation, causing the application to crash and become unavailable. This affects anyone running TensorFlow-based applications that load untrusted models.
Technical details
The vulnerability is a division-by-zero error (CWE-369) in the LSH operation within TFLite. The vulnerable code divides by the first dimension of the input tensor without checking that it is non-zero: `int input_item_bytes = input->bytes / SizeOfDimension(input, 0)`. An attacker can craft a malicious TFLite model with a zero-sized first dimension to trigger this crash. The attack requires only the ability to provide a model file to the application; no special privileges or user interaction are needed once the model is loaded. This results in a denial-of-service condition. Patches are available in TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0.
Affected products
- Google TensorFlow < 2.3.4, 2.4.0-2.4.2, 2.5.0
- Google TensorFlow CPU < 2.3.4, 2.4.0-2.4.2, 2.5.0
- Google TensorFlow GPU < 2.3.4, 2.4.0-2.4.2, 2.5.0
Timeline
- 2021-08-11: disclosed: Advisory published
- 2021-08: patched: Patches released in TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0