CVE-2021-29544: CHECK-fail in `QuantizeAndDequantizeV4Grad`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.QuantizeAndDequantizeV4Grad:

python import tensorflow as tf

gradienttensor = tf.constant([0.0], shape=[1]) inputtensor = tf.constant([0.0], shape=[1]) inputmin = tf.constant([[0.0]], shape=[1, 1]) inputmax = tf.constant([[0.0]], shape=[1, 1])

tf.rawops.QuantizeAndDequantizeV4Grad( gradients=gradienttensor, input=inputtensor, inputmin=inputmin, inputmax=inputmax, axis=0) This is because the implementation does not validate the rank of the input tensors. In turn, this results in the tensors being passes as they are to QuantizeAndDequantizePerChannelGradientImpl:

cc template <typename Device, typename T> struct QuantizeAndDequantizePerChannelGradientImpl { static void Compute(const Device& d, typename TTypes<T, 3>::ConstTensor gradient, typename TTypes<T, 3>::ConstTensor input, const Tensor inputmintensor, const Tensor inputmaxtensor, typename TTypes<T, 3>::Tensor inputbackprop, typename TTypes<T>::Flat inputminbackprop, typename TTypes<T>::Flat inputmaxbackprop) { ... auto inputmin = inputmintensor->vec<T>(); auto inputmax = inputmaxtensor->vec<T>(); ... }

However, the vec<T> method, requires the rank to 1 and triggers a CHECK failure otherwise.

Patches We have patched the issue in GitHub commit 20431e9044cf2ad3c0323c34888b192f3289af6b.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.

For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.