CVE-2021-29564: TensorFlow Null Pointer Dereference in tf.raw_ops.EditDistance
Summary
CVE-2021-29564: Null pointer dereference in EditDistance. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29564 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. The vulnerability described here affects the implementation of tf.raw_ops.EditDistance in TensorFlow.
Vulnerability Detail
The vulnerability arises due to incomplete validation of input parameters in the implementation of tf.raw_ops.EditDistance. An attacker can exploit this vulnerability to trigger a null pointer dereference. This can lead to a crash or potentially allow the attacker to execute arbitrary code. The vulnerability has been assigned the identifier CVE-2021-29564 and has a CVSSv3 score of 7.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the tf.raw_ops.EditDistance operation until the fixed versions of TensorFlow are available. Alternatively, users can implement their own custom distance calculation logic as a substitute for tf.raw_ops.EditDistance.
Conclusion
The vulnerability in TensorFlow's tf.raw_ops.EditDistance operation can be exploited to trigger a null pointer dereference, potentially leading to a crash or arbitrary code execution. Users are advised to update their TensorFlow installations to the fixed versions once they are available. As a temporary workaround, users can avoid using the vulnerable operation or implement their own custom distance calculation logic. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for developing and deploying machine learning models.
tf.raw_ops.EditDistance is an operation in TensorFlow that calculates the edit distance between sequences.
A null pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer, resulting in a crash or potentially allowing an attacker to execute arbitrary code.
An attacker can exploit this vulnerability by providing malicious input to the tf.raw_ops.EditDistance operation, triggering a null pointer dereference and potentially causing a crash or allowing the execution of arbitrary code.
To protect your TensorFlow installation, it is recommended to update to the fixed versions once they are available. Regularly updating TensorFlow ensures that you have the latest security patches applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
