CVE-2021-29513: Type confusion during tensor casts lead to dereferencing null pointers

Impact Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences.

There are multiple ways to reproduce this, listing a few examples here:

python import tensorflow as tf import numpy as np data = tf.random.truncatednormal(shape=1,mean=np.float32(20.8739),stddev=779.973,dtype=20,seed=64)

python import tensorflow as tf import numpy as np data = tf.random.statelesstruncatednormal(shape=1,seed=[63,70],mean=np.float32(20.8739),stddev=779.973,dtype=20)

python import tensorflow as tf import numpy as np data = tf.onehot(indices=[62,50],depth=136,onvalue=np.int32(237),offvalue=158,axis=856,dtype=20)

python import tensorflow as tf import numpy as np data = tf.range(start=np.int32(214),limit=660,delta=129,dtype=20)

python import tensorflow as tf import numpy as np data = tf.rawops.ResourceCountUpTo(resource=np.int32(30), limit=872, T=3)

python import tensorflow as tf import numpy as np

writerarray = np.array([1,2],dtype=np.int32) writertensor = tf.converttotensor(writerarray,dtype=tf.resource)

All these examples and similar ones have the same behavior: the conversion from Python array to C++ array is vulnerable to a type confusion:

cc int pyarraytype = PyArrayTYPE(array); PyArrayDescr descr = PyArrayDESCR(array); switch (pyarraytype) { ... case NPYVOID: // Quantized types are currently represented as custom struct types. // PyArrayTYPE returns NPYVOID for structs, and we should look into // descr to derive the actual type. // Direct feeds of certain types of ResourceHandles are represented as a // custom struct type. return PyArrayDescrtoTFDataType(descr, outtfdatatype); ... }

For the tensor types involved in the above example, the pyarraytype is NPYVOID but the descr field is such that descr->field = NULL. Then PyArrayDescrtoTFDataType will trigger a null dereference:

cc Status PyArrayDescrtoTFDataType(PyArrayDescr descr, TFDataType outtfdatatype) { PyObject key; PyObject value; Pyssizet pos = 0; if (PyDictNext(descr->fields, &pos, &key, &value)) { ... } }

This is because the Python's PyDictNext implementation would dereference the first argument.

Patches We have patched the issue in GitHub commit 030af767d357d1b4088c4a25c72cb3906abac489.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360 as well as Ye Zhang and Yakun Zhang of Baidu X-Team.