CVE-2021-29571

TensorFlow MaxPoolGradWithArgmax Heap overflow via malicious inputs

• CVSS 7.8
• CWE-787 Out-of-bounds Write
• Memory Corruption
• Local

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/31bd5026304677faa8a0b77602c6154171b9aec1/tensorflow/core/kernels/image/draw_bounding_box_op.cc#L116-L130) assumes that the last element of `boxes` input is 4, as required by [the op](https://www.tensorflow.org/api_docs/python/tf/raw_ops/DrawBoundingBoxesV2). Since this is not checked attackers passing values less than 4 can write outside of bounds of heap allocated objects and cause memory corruption. If the last dimension in `boxes` is less than 4, accesses similar to `tboxes(b, bb, 3)` will access data outside of bounds. Further during code execution there are also writes to these indices. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

CVE

CVE-2021-29571

CWE

CWE-787 Out-of-bounds Write

CVSS base score

7.8

Published

2021-05-14

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Memory Corruption

Subcategory

Out-of-Bound Accesses

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

TensorFlow

Fixed by upgrading

Yes

Solution

Update TensorFlow to version 2.5.0 or higher.

import tensorflow as tf

def draw_bounding_boxes(boxes, image, colors):
    return tf.raw_ops.DrawBoundingBoxesV2(boxes=boxes, image=image, colors=colors)

boxes = tf.constant([[0.1, 0.2, 0.5, 0.5], [0.3, 0.3]], dtype=tf.float32)
image = tf.zeros([100, 100, 3], dtype=tf.float32)
colors = tf.constant([[1.0, 0.0, 0.0]], dtype=tf.float32)

try:
    output_image = draw_bounding_boxes(boxes, image, colors)
    print("Output image:", output_image)
except Exception as e:
    print("Error during DrawBoundingBoxesV2:", e)
    if "index out of bounds" in str(e).lower() or "out of range" in str(e).lower():
        print("Out-of-bounds access triggered.")
    else:
        print("Error occurred.")

import tensorflow as tf

def draw_bounding_boxes(boxes, image, colors):
    if boxes.shape[-1] != 4:
        raise ValueError(
            "The last dimension of 'boxes' must be 4 (ymin, xmin, ymax, xmax). "
            f"Got {boxes.shape[-1]}."
        )

    return tf.raw_ops.DrawBoundingBoxesV2(boxes=boxes, image=image, colors=colors)

boxes = tf.constant([[0.1, 0.2, 0.5, 0.5], [0.3, 0.3]], dtype=tf.float32)
image = tf.zeros([100, 100, 3], dtype=tf.float32)
colors = tf.constant([[1.0, 0.0, 0.0]], dtype=tf.float32)

try:
    output_image = draw_bounding_boxes(boxes, image, colors)
    print("Output image:", output_image)
except Exception as e:
    print("Error during DrawBoundingBoxesV2:", e)
    if "index out of bounds" in str(e).lower() or "out of range" in str(e).lower():
        print("Out-of-bounds access triggered.")
    else:
        print("Error occurred.")

@misc{vaitp:cve202129571,
  title        = {{TensorFlow MaxPoolGradWithArgmax Heap overflow via malicious inputs}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-29571},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-29571/}}
}