Junglewise Threat Intelligence

CVE-2021-37691: PYSEC-2021-802 - TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would

CVE-2021-37691 · Severity: low · CVSS 3.1 · Published 2021-08-12

Technologies: tensorflow-cpu (PyPI), tensorflow-gpu (PyPI), Google TensorFlow, tensorflow (PyPI). Vendors: Google, PyPI.

Executive brief

TensorFlow is a machine learning library that includes TFLite, a lightweight runtime for deploying neural networks. An attacker can craft a specially designed model that triggers a division-by-zero crash in the LSH (Locality Sensitive Hashing) implementation, causing the application to crash and become unavailable. This affects anyone running TensorFlow-based applications that load untrusted models.

Technical details

The vulnerability is a division-by-zero error (CWE-369) in the LSH operation within TFLite. The vulnerable code divides by the first dimension of the input tensor without checking that it is non-zero: `int input_item_bytes = input->bytes / SizeOfDimension(input, 0)`. An attacker can craft a malicious TFLite model with a zero-sized first dimension to trigger this crash. The attack requires only the ability to provide a model file to the application; no special privileges or user interaction are needed once the model is loaded. This results in a denial-of-service condition. Patches are available in TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0.

Affected products

  • Google TensorFlow < 2.3.4, 2.4.0-2.4.2, 2.5.0
  • Google TensorFlow CPU < 2.3.4, 2.4.0-2.4.2, 2.5.0
  • Google TensorFlow GPU < 2.3.4, 2.4.0-2.4.2, 2.5.0

Timeline

  • 2021-08-11: disclosed: Advisory published
  • 2021-08: patched: Patches released in TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0

References

Related threats