Advisoriesby IbisSession operations in eager mode lead to null pointer dereferences
Impact
In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference:
```python
import tensorflow as tf
tf.raw_ops.GetSessionTensor(handle=['\x12\x1a\x07'],dtype=4)
`
```python
import tensorflow as tf
tf.raw_ops.DeleteSessionTensor(handle=['\x12\x1a\x07'])
`
The [implementation](https://github.com/tensorflow/tensorflow/blob/eebb96c2830d48597d055d247c0e9aebaea94cd5/tensorflow/core/kernels/session_ops.cc#L104) dereferences the session state pointer without checking if it is valid:
```cc
OP_REQUIRES_OK(ctx, ctx->session_state()->GetTensor(name, &val));
`
Thus, in eager mode, ctx->session_state() is nullptr and the call of the member function is undefined behavior.
Patches
We have patched the issue in GitHub commit [ff70c47a396ef1e3cb73c90513da4f5cb71bebba](https://github.com/tensorflow/tensorflow/commit/ff70c47a396ef1e3cb73c90513da4f5cb71bebba).
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.1.4 | 2.1.4 |
| >= 2.2.0, < 2.2.3 | 2.2.3 | |
| >= 2.3.0, < 2.3.3 | 2.3.3 | |
| >= 2.4.0, < 2.4.2 | 2.4.2 |
Details and references
### Impact In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference: ```python import tensorflow as tf tf.raw_ops.GetSessionTensor(handle=['\x12\x1a\x07'],dtype=4) ``` ```python import tensorflow as tf tf.raw_ops.DeleteSessionTensor(handle=['\x12\x1a\x07']) ``` The [implementation](https://github.com/tensorflow/tensorflow/blob/eebb96c2830d48597d055d247c0e9aebaea94cd5/tensorflow/core/kernels/session_ops.cc#L104) dereferences the session state pointer without checking if it is valid: ```cc OP_REQUIRES_OK(ctx, ctx->session_state()->GetTensor(name, &val)); ``` Thus, in eager mode, `ctx->session_state()` is nullptr and the call of the member function is undefined behavior. ### Patches We have patched the issue in GitHub commit [ff70c47a396ef1e3cb73c90513da4f5cb71bebba](https://github.com/tensorflow/tensorflow/commit/ff70c47a396ef1e3cb73c90513da4f5cb71bebba). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-476
- Also known as
- BIT-tensorflow-2021-29518, CVE-2021-29518, PYSEC-2021-155, PYSEC-2021-446, PYSEC-2021-644
- github.com/tensorflow/tensorflow/security/advisories/GHSA-62gx-355r-9fhg
- nvd.nist.gov/vuln/detail/CVE-2021-29518
- github.com/tensorflow/tensorflow/commit/ff70c47a396ef1e3cb73c90513da4f5cb71bebba
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-446.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-644.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-155.yaml
More TensorFlow advisories
All TensorFlow
Segfault in `tf.raw_ops.SparseCountSparseOutput`CVE-2021-29619fixed in 2.1.4 +3Crash in `tf.transpose` with complex inputsCVE-2021-29618fixed in 2.1.4 +3Crash in `tf.strings.substr` due to `CHECK`-failCVE-2021-29617fixed in 2.1.4 +3Null dereference in Grappler's `TrySimplify`CVE-2021-29616fixed in 2.1.4 +3Stack overflow in `ParseAttrValue` with nested tensorsCVE-2021-29615fixed in 2.1.4 +3Interpreter crash from `tf.io.decode_raw`CVE-2021-29614fixed in 2.1.4 +3