CVE-2021-29571: TensorFlow - Out-of-Bounds Read Vulnerability
Summary
CVE-2021-29571: Memory corruption in DrawBoundingBoxesV2. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29571 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and applications.
Vulnerability Detail
The implementation of tf.raw_ops.MaxPoolGradWithArgmax in TensorFlow can lead to an out-of-bounds read vulnerability. This vulnerability occurs when an attacker supplies specially crafted inputs to the tf.raw_ops.MaxPoolGradWithArgmax function. The implementation assumes that the last element of the boxes input is 4, as required by the DrawBoundingBoxesV2 operation. However, this assumption is not checked, allowing attackers to pass values less than 4 and access data outside the bounds of heap allocated objects. This can result in memory corruption and potential exploitation of the system. The vulnerability has been assigned CVE-2021-29571.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. Users are strongly encouraged to update to the fixed versions of TensorFlow as soon as they are released.
Conclusion
The out-of-bounds read vulnerability in TensorFlow can have serious security implications. It is crucial for users to update their TensorFlow installations to the fixed versions as soon as they become available. Regularly checking for updates and promptly applying them is recommended to ensure the security of TensorFlow deployments. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
This vulnerability can lead to memory corruption and potential exploitation of the system. Attackers can supply specially crafted inputs to access data outside the bounds of heap allocated objects.
The fix for this vulnerability will be included in TensorFlow 2.5.0. Users should update their TensorFlow installations to the fixed versions as soon as they become available.
Currently, there are no known workarounds for this vulnerability. It is recommended to update to the fixed versions of TensorFlow.
For more information about this vulnerability, you can refer to the official TensorFlow documentation and the CVE-2021-29571 entry.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
