CVE-2021-29531: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2021-29531: CHECK-fail in tf.raw_ops.EncodePng. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29531 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow is widely used in various industries for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service attack.
Vulnerability Detail
The vulnerability in TensorFlow arises from a flaw in the PNG encoding functionality. When encoding an image, the implementation fails to validate the input tensor for empty pixel data. This allows an attacker to provide an empty matrix as input, resulting in a null pointer dereference. As a consequence, the program crashes with an abort call, effectively causing a denial of service. This vulnerability can be exploited remotely by an attacker with the ability to send malicious input to the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow can lead to a denial of service attack by crashing the affected application. It is crucial to upgrade to the patched versions of TensorFlow or apply the necessary updates to mitigate the risk. Regularly checking for updates and following best practices for software security is recommended. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
This vulnerability allows an attacker to mount a denial of service attack by crashing the affected TensorFlow application. This can lead to service disruption and potential loss of data.
Yes, this vulnerability can be exploited remotely by an attacker who can send malicious input to the affected system.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to apply the necessary patches and updates to mitigate the risk.
Yes, the TensorFlow development team has released patches for this vulnerability in TensorFlow versions 2.5.0, 2.4.2, 2.3.3, 2.2.3, and 2.1.4. It is recommended to upgrade to the latest patched version.
For more information about this vulnerability, you can refer to the official TensorFlow security advisory or contact the TensorFlow development team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
