PYSEC-2021-168
Vulnerability from pysec - Published: 2021-05-14 20:15 - Updated: 2021-08-27 03:22TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a CHECK fail in PNG encoding by providing an empty input tensor as the pixel data. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L57-L60) only validates that the total number of pixels in the image does not overflow. Thus, an attacker can send an empty matrix for encoding. However, if the tensor is empty, then the associated buffer is nullptr. Hence, when calling png::WriteImageToBuffer(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L79-L93), the first argument (i.e., image.flat<T>().data()) is NULL. This then triggers the CHECK_NOTNULL in the first line of png::WriteImageToBuffer(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/lib/png/png_io.cc#L345-L349). Since image is null, this results in abort being called after printing the stacktrace. Effectively, this allows an attacker to mount a denial of service attack. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
| Name | purl | tensorflow | pkg:pypi/tensorflow |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow",
"purl": "pkg:pypi/tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26eb323554ffccd173e8a79a8c05c15b685ae4d1"
}
],
"repo": "https://github.com/tensorflow/tensorflow",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.4"
},
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.3"
},
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.3"
},
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.12.0",
"0.12.0rc0",
"0.12.0rc1",
"0.12.1",
"1.0.0",
"1.0.1",
"1.1.0",
"1.1.0rc0",
"1.1.0rc1",
"1.1.0rc2",
"1.10.0",
"1.10.0rc0",
"1.10.0rc1",
"1.10.1",
"1.11.0",
"1.11.0rc0",
"1.11.0rc1",
"1.11.0rc2",
"1.12.0",
"1.12.0rc0",
"1.12.0rc1",
"1.12.0rc2",
"1.12.2",
"1.12.3",
"1.13.0rc0",
"1.13.0rc1",
"1.13.0rc2",
"1.13.1",
"1.13.2",
"1.14.0",
"1.14.0rc0",
"1.14.0rc1",
"1.15.0",
"1.15.0rc0",
"1.15.0rc1",
"1.15.0rc2",
"1.15.0rc3",
"1.15.2",
"1.15.3",
"1.15.4",
"1.15.5",
"1.2.0",
"1.2.0rc0",
"1.2.0rc1",
"1.2.0rc2",
"1.2.1",
"1.3.0",
"1.3.0rc0",
"1.3.0rc1",
"1.3.0rc2",
"1.4.0",
"1.4.0rc0",
"1.4.0rc1",
"1.4.1",
"1.5.0",
"1.5.0rc0",
"1.5.0rc1",
"1.5.1",
"1.6.0",
"1.6.0rc0",
"1.6.0rc1",
"1.7.0",
"1.7.0rc0",
"1.7.0rc1",
"1.7.1",
"1.8.0",
"1.8.0rc0",
"1.8.0rc1",
"1.9.0",
"1.9.0rc0",
"1.9.0rc1",
"1.9.0rc2",
"2.0.0",
"2.0.0a0",
"2.0.0b0",
"2.0.0b1",
"2.0.0rc0",
"2.0.0rc1",
"2.0.0rc2",
"2.0.1",
"2.0.2",
"2.0.3",
"2.0.4",
"2.1.0",
"2.1.0rc0",
"2.1.0rc1",
"2.1.0rc2",
"2.1.1",
"2.1.2",
"2.1.3",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.3.2",
"2.4.0",
"2.4.1"
]
}
],
"aliases": [
"CVE-2021-29531",
"GHSA-3qxp-qjq7-w4hf"
],
"details": "TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a `CHECK` fail in PNG encoding by providing an empty input tensor as the pixel data. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L57-L60) only validates that the total number of pixels in the image does not overflow. Thus, an attacker can send an empty matrix for encoding. However, if the tensor is empty, then the associated buffer is `nullptr`. Hence, when calling `png::WriteImageToBuffer`(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L79-L93), the first argument (i.e., `image.flat\u003cT\u003e().data()`) is `NULL`. This then triggers the `CHECK_NOTNULL` in the first line of `png::WriteImageToBuffer`(https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/lib/png/png_io.cc#L345-L349). Since `image` is null, this results in `abort` being called after printing the stacktrace. Effectively, this allows an attacker to mount a denial of service attack. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.",
"id": "PYSEC-2021-168",
"modified": "2021-08-27T03:22:26.851089Z",
"published": "2021-05-14T20:15:00Z",
"references": [
{
"type": "FIX",
"url": "https://github.com/tensorflow/tensorflow/commit/26eb323554ffccd173e8a79a8c05c15b685ae4d1"
},
{
"type": "ADVISORY",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3qxp-qjq7-w4hf"
}
]
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.