CVE-2021-29551: TensorFlow MatrixTriangularSolve Kernel Execution Termination Failure
Summary
CVE-2021-29551: OOB read in MatrixTriangularSolve. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29551 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for developing and deploying machine learning models. The MatrixTriangularSolve implementation in TensorFlow is responsible for solving triangular matrix equations. This vulnerability affects versions 0 and 2.1.4 to 2.4.2 of the TensorFlow package.
Vulnerability Detail
The vulnerability arises from a flaw in the implementation of the MatrixTriangularSolve function. Specifically, the kernel execution fails to terminate if one validation condition fails. This can lead to unexpected behavior and potential security risks. The issue has been assigned the identifier CVE-2021-29551 and has a CVSSv3 severity score of 6.5 (Medium). It was discovered by the TensorFlow security team and reported on November 6, 2023.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the MatrixTriangularSolve function until they have upgraded to a fixed version of TensorFlow. Alternatively, they can implement their own custom solution for solving triangular matrix equations.
Conclusion
In conclusion, the vulnerability in the TensorFlow package's MatrixTriangularSolve function can result in kernel execution failure and potential security risks. Users are advised to upgrade to TensorFlow 2.5.0 or later to mitigate this issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
The MatrixTriangularSolve function in TensorFlow is used for solving triangular matrix equations.
This vulnerability affects versions 0 and 2.1.4 to 2.4.2 of the TensorFlow package, specifically in the MatrixTriangularSolve implementation.
The failure to terminate kernel execution in the MatrixTriangularSolve function can lead to unexpected behavior and potential security risks.
To fix this vulnerability, users should upgrade their TensorFlow installations to version 2.5.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
