Executive brief
TensorFlow is an open-source machine learning framework widely used for building and training AI models. The SparseBinCount operation in TensorFlow contains a heap buffer overflow vulnerability caused by missing input validation. An attacker with the ability to invoke this operation with maliciously crafted arguments could read or write to memory outside intended bounds, potentially leading to information disclosure or denial of service.
Technical details
The vulnerability is a heap out-of-bounds (OOB) access in the SparseBinCount operation due to missing validation between the elements of the `values` argument and the shape of the sparse output tensor. When the operation processes sparse tensor indices, it directly uses unchecked values as bin indices without verifying they are within the allocated tensor bounds. This allows an attacker to craft sparse tensor inputs where the `values` parameter contains indices larger than the output tensor dimensions, causing writes or reads beyond allocated heap memory. The vulnerability affects TensorFlow versions prior to 2.7.0, with patches available for 2.4.4, 2.5.2, and 2.6.1.
Affected products
- Google TensorFlow before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1, 2.7.0
- Google TensorFlow CPU before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1
- Google TensorFlow GPU before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1
Timeline
- 2021-11-04: disclosed
- 2021-11-10: patched: Fix included in TensorFlow 2.7.0 and backported to 2.6.1, 2.5.2, 2.4.4