Null pointer exception in TensorFlow Lite

Summary

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is vulnerable to a null pointer error. The `GetVariableInput` function can return a null pointer but `GetTensorData` assumes that the argument is always a valid tensor. Furthermore, because `GetVariableInput` calls `GetMutableInput` which might return `nullptr`, the `tensor->is_variable` expression can also trigger a null pointer exception. We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Timeline

1. Aug 12, 2021, 10:00 PM UTCCVE published
2. Aug 4, 2024, 1:23 AM UTCRecord last updated

Affected versions

• tensorflow tensorflow

  From 2.5.0 · fixed in 2.5.1; From 2.4.0 · fixed in 2.4.3; fixed in 2.3.4

• tensorflowPyPI

  From 2.3.0 · fixed in 2.3.4; From 2.4.0 · fixed in 2.4.3

• tensorflow-cpuPyPI

  From 2.3.0 · fixed in 2.3.4; From 2.4.0 · fixed in 2.4.3

• tensorflowPyPI

  fixed in 2.3.4

• tensorflowPyPI

  From 2.4.0 · fixed in 2.4.3

• tensorflowPyPI

  From 2.5.0 · fixed in 2.5.1

• tensorflow-cpuPyPI

  fixed in 2.3.4

• tensorflow-cpuPyPI

  From 2.4.0 · fixed in 2.4.3

• tensorflow-cpuPyPI

  From 2.5.0 · fixed in 2.5.1

• tensorflow-gpuPyPI

  fixed in 2.3.4

• tensorflow-gpuPyPI

  From 2.4.0 · fixed in 2.4.3

• tensorflow-gpuPyPI

  From 2.5.0 · fixed in 2.5.1

• tensorflow-gpuPyPI

  From 2.3.0 · fixed in 2.3.4; From 2.4.0 · fixed in 2.4.3

References 2