1## TFSA-2020-023: Memory corruption in `dlpack.to_dlpack` 2 3### CVE Number 4CVE-2020-15193 5 6### Impact 7The implementation of `dlpack.to_dlpack` can be made to use uninitialized 8memory resulting in further memory corruption. This is because the pybind11 9glue code [assumes that the argument is a 10tensor](https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/tfe_wrapper.cc#L1361): 11```cc 12 TFE_TensorHandle* thandle = EagerTensor_Handle(eager_tensor_pyobject_ptr); 13``` 14 15However, there is nothing stopping users from passing in a Python object instead of a tensor. 16```python 17In [2]: tf.experimental.dlpack.to_dlpack([2]) 18==1720623==WARNING: MemorySanitizer: use-of-uninitialized-value 19 #0 0x55b0ba5c410a in tensorflow::(anonymous namespace)::GetTensorFromHandle(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:46:7 20 #1 0x55b0ba5c38f4 in tensorflow::TFE_HandleToDLPack(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:252:26 21... 22``` 23 24The uninitialized memory address is due to a 25[`reinterpret_cast`](https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/eager/pywrap_tensor.cc#L848-L850): 26```cc 27TFE_TensorHandle* EagerTensor_Handle(const PyObject* o) { 28 return reinterpret_cast<const EagerTensor*>(o)->handle; 29} 30``` 31 32Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. 33 34### Vulnerable Versions 35TensorFlow 2.2.0, 2.3.0. 36 37### Patches 38We have patched the issue in 39[22e07fb204386768e5bcbea563641ea11f96ceb8](https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8) 40and will release a patch release for all affected versions. 41 42We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1. 43 44### For more information 45Please consult [our security 46guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for 47more information regarding the security model and how to contact us with issues 48and questions. 49 50### Attribution 51This vulnerability has been reported by members of the Aivul Team from Qihoo 52360. 53