CVE-2021-29565: TensorFlow - Null Pointer Dereference in SparseFillEmptyRows
Summary
CVE-2021-29565: Null pointer dereference in SparseFillEmptyRows. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29565 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow is widely used in various industries and research fields.
Vulnerability Detail
The vulnerability (CVE-2021-29565) in TensorFlow is due to a null pointer dereference in the implementation of tf.raw_ops.SparseFillEmptyRows. The issue arises from missing validation in the code, specifically in the handling of the dense_shape tensor. If the dense_shape tensor is empty, a null pointer dereference occurs, leading to a crash or potential exploitation by an attacker. The vulnerability has a medium severity rating and affects multiple versions of TensorFlow.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow (CVE-2021-29565) is a medium severity issue that can result in a null pointer dereference. Users are advised to update their TensorFlow installations to the fixed versions as soon as they are released. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning, widely used for building and deploying machine learning models.
The vulnerability can lead to a null pointer dereference, causing a crash or potential exploitation by an attacker.
The vulnerability affects TensorFlow versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
The vulnerability can be fixed by updating to the patched versions of TensorFlow (2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4) when they become available.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
