Executive brief
TensorFlow is an open-source machine learning framework widely used for training and deploying neural networks. The LSTMBlockCell operation, a core component used in recurrent neural network models, lacks proper validation of input tensor dimensions. An attacker can trigger a denial of service crash by providing tensors with incorrect shapes, causing the TensorFlow process to terminate unexpectedly and disrupting any ML inference or training workload relying on it.
Technical details
The vulnerability exists in tf.raw_ops.LSTMBlockCell, which fails to validate the rank (number of dimensions) of input tensors before processing them. The vulnerability is a missing input validation issue (CWE-20) that allows a local attacker to craft a Python script with malformed tensor dimensions and trigger a CHECK-failure during element access. The attack requires direct access to a TensorFlow process or application that calls LSTMBlockCell; no network access or authentication bypass is needed. An attacker achieves denial of service by crashing the process, not code execution or data compromise. Fixes were released in TensorFlow 2.6.4, 2.7.2, 2.8.1, and 2.9.0.
Affected products
- Google TensorFlow before 2.6.4, 2.7.0–2.7.1, 2.8.0
- Google TensorFlow CPU before 2.6.4, 2.7.0–2.7.1, 2.8.0
- Google TensorFlow GPU before 2.6.4, 2.7.0–2.7.1, 2.8.0
Timeline
- 2022-05-17: disclosed
- 2022-05-24: advisory
- 2022-05-24: patched: Patched in TensorFlow 2.6.4, 2.7.2, 2.8.1, and 2.9.0