CVE-2021-29567: TensorFlow - Denial of Service Vulnerability
Summary
CVE-2021-29567: Lack of validation in SparseDenseCwiseMul. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29567 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to denial of service attacks.
Vulnerability Detail
The vulnerability (CVE-2021-29567) in TensorFlow arises due to a lack of validation in the tf.raw_ops.SparseDenseCwiseMul function. This vulnerability can be exploited by an attacker to trigger denial of service by causing CHECK-fails or accessing memory outside the bounds of heap allocated data. The implementation of SparseDenseCwiseMul only validates the rank of the input arguments, but does not enforce constraints between dimensions. This allows an attacker to abuse the dimensions and trigger internal CHECK assertions, leading to program termination and denial of service. Additionally, the attacker can also write to memory outside the bounds of heap allocated tensor buffers.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can follow the steps mentioned in the 'how_to_fix' section to update to the latest version or apply the necessary patches.
Conclusion
The vulnerability in TensorFlow (CVE-2021-29567) can lead to denial of service attacks and potential disruption of machine learning applications. It is crucial to update to the latest version of TensorFlow or apply the provided patches to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for developing and deploying machine learning models.
This vulnerability in TensorFlow can lead to denial of service attacks, causing program termination and potential disruption of machine learning applications.
The vulnerability affects TensorFlow versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
There are no known exploits for this vulnerability at the moment. However, it is important to update to the latest version or apply the patches to mitigate the risk.
You can find more information about this vulnerability in the official TensorFlow documentation and the associated CVE entry.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
