CVE-2021-29512: TensorFlow Heap Buffer Overflow in RaggedBincount
Summary
CVE-2021-29512: Heap buffer overflow in RaggedBinCount. Affects tensorflow across 2 version ranges.
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 2.3.3 or 2.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29512 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. TensorFlow allows developers to create and train machine learning models using various techniques such as deep learning, reinforcement learning, and more. It is widely used in both research and production environments.
Vulnerability Detail
The vulnerability identified as CVE-2021-29512 affects TensorFlow versions 2.3.0 to 2.4.2. It resides in the RaggedBincount operation, specifically in the handling of the splits argument. If the splits argument does not specify a valid SparseTensor, it can trigger a heap buffer overflow. This overflow leads to a read operation outside the bounds of the splits tensor buffer, potentially causing memory corruption and arbitrary code execution. The vulnerability has a high severity rating (CVSS score: 9.8) and can be exploited by an attacker with low privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid passing an invalid splits argument to the RaggedBincount operation. Ensure that the splits argument specifies a valid SparseTensor to prevent triggering the heap buffer overflow. Here is an example of a valid splits argument:
import tensorflow as tf
splits = tf.sparse.SparseTensor(indices=[[0, 0], [1, 0], [2, 0]], values=[1, 2, 3], dense_shape=[3, 1])
result = tf.RaggedTensor.from_sparse(splits)
Conclusion
The vulnerability identified as CVE-2021-29512 in TensorFlow can lead to a heap buffer overflow and potential memory corruption. It is crucial for users to update their TensorFlow installation to one of the patched versions (2.3.3, 2.4.2, or 2.5.0) to mitigate the risk. Additionally, users can follow the provided workaround to prevent triggering the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive set of tools and resources for building and deploying machine learning models.
The vulnerability can lead to a heap buffer overflow, potentially resulting in memory corruption and arbitrary code execution. It has a high severity rating and can be exploited by an attacker with low privileges.
The vulnerability affects TensorFlow versions 2.3.0 to 2.4.2.
To fix the vulnerability, update your TensorFlow installation to one of the patched versions: 2.3.3, 2.4.2, or 2.5.0.
Yes, as a temporary workaround, ensure that the splits argument passed to the RaggedBincount operation specifies a valid SparseTensor.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
