CVE-2021-29577: TensorFlow - Heap Buffer Overflow in tf.raw_ops.AvgPool3DGrad
Summary
CVE-2021-29577: Heap buffer overflow in AvgPool3DGrad. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in the implementation of tf.raw_ops.AvgPool3DGrad function, which can lead to a heap buffer overflow.
Vulnerability Detail
The vulnerability exists in the implementation of tf.raw_ops.AvgPool3DGrad in TensorFlow. The function assumes that the orig_input_shape and grad tensors have similar first and last dimensions, but it does not validate this assumption. As a result, an attacker can craft malicious input that triggers a heap buffer overflow, potentially leading to arbitrary code execution or a denial of service (DoS) condition. The vulnerability has been assigned CVE-2021-29577 and has a CVSSv3 score of 9.8 (Critical).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading TensorFlow to the latest version or the corresponding fixed version.
Conclusion
In conclusion, the vulnerability in TensorFlow's tf.raw_ops.AvgPool3DGrad function can lead to a heap buffer overflow, potentially enabling arbitrary code execution or causing a denial of service (DoS) condition. It is crucial to update TensorFlow to the latest version or the corresponding fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools, libraries, and resources for building and deploying machine learning models.
The vulnerability can lead to a heap buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service (DoS) condition.
The vulnerability affects TensorFlow versions 2.1.4 and later, including 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
Yes, the vulnerability has been fixed in TensorFlow 2.5.0. The fix has also been backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
To protect your TensorFlow applications, it is recommended to upgrade to the latest version of TensorFlow or the corresponding fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
