CVE-2021-29519: TensorFlow - Type Confusion in SparseCross API
Summary
CVE-2021-29519: CHECK-fail in SparseCross due to type confusion. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29519 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. The tf.raw_ops.SparseCross API in TensorFlow allows users to perform sparse cross operations. This API is used to compute the dot product of two sparse tensors. Sparse tensors are tensors that contain mostly zero values. The SparseCross API is a critical component in many machine learning applications that involve sparse data, such as recommendation systems and natural language processing.
Vulnerability Detail
The vulnerability identified as CVE-2021-29519 is a type confusion issue in the tf.raw_ops.SparseCross API of TensorFlow. This vulnerability can be exploited by providing combinations of input tensors that trick the implementation into considering a tensor of type tstring as containing integral elements. This type confusion can lead to a CHECK failure and denial of service. The impact of this vulnerability is a potential crash or termination of the TensorFlow application, resulting in a denial of service condition. The vulnerability affects versions of TensorFlow ranging from 0 to 2.4.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the tf.raw_ops.SparseCross API until they have upgraded to a patched version of TensorFlow. Alternatively, users can modify their code to ensure that the input tensors provided to the tf.raw_ops.SparseCross API do not mix DT_STRING and DT_INT64 types. This can be achieved by carefully validating and preprocessing the input data to ensure consistent data types.
Conclusion
The vulnerability identified as CVE-2021-29519 in TensorFlow's tf.raw_ops.SparseCross API can lead to a denial of service condition. It is recommended to upgrade to TensorFlow 2.5.0 or apply the respective patches for earlier versions. Users can refer to the official TensorFlow documentation for detailed instructions on upgrading or patching their TensorFlow installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
The tf.raw_ops.SparseCross API is used in TensorFlow to compute the dot product of two sparse tensors. It is commonly used in machine learning applications that involve sparse data.
Type confusion is a vulnerability that occurs when a program mistakenly interprets data of one type as another type. In the case of this vulnerability, the TensorFlow implementation is tricked into considering a tensor of type tstring as containing integral elements.
The impact of this vulnerability is a potential crash or termination of the TensorFlow application, resulting in a denial of service condition.
To fix this vulnerability, it is recommended to upgrade to TensorFlow 2.5.0 or later. Alternatively, users can apply the respective patches for TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Detailed instructions can be found in the official TensorFlow documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
