CVE-2021-29580: TensorFlow - FractionalMaxPoolGrad Function Denial of Service Vulnerability
Summary
CVE-2021-29580: Undefined behavior and CHECK-fail in FractionalMaxPoolGrad. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29580 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. The tf.raw_ops.FractionalMaxPoolGrad function is responsible for performing fractional max pooling in TensorFlow. This function is vulnerable to a denial of service attack and triggers undefined behavior if one of the input tensors is empty. The vulnerability arises due to the lack of validation for empty input and output tensors, as well as the assumption that the tensors are of the same rank.
Vulnerability Detail
The implementation of tf.raw_ops.FractionalMaxPoolGrad in TensorFlow allows an attacker to exploit the vulnerability by providing empty input tensors. This triggers an undefined behavior and can lead to a denial of service attack. Additionally, a CHECK condition becomes false, causing the process to abort. The impact of this vulnerability can be severe, as it can disrupt the availability of TensorFlow-based machine learning systems. The vulnerability affects versions 0 and above of TensorFlow, including versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided patches or upgrade to the fixed versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow's tf.raw_ops.FractionalMaxPoolGrad function can lead to a denial of service attack and trigger undefined behavior. It is crucial to upgrade to the fixed versions or apply the provided patches to ensure the security and availability of TensorFlow-based machine learning systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for building and deploying machine learning models.
This vulnerability can be exploited to trigger a denial of service attack and disrupt the availability of TensorFlow-based machine learning systems.
The vulnerability affects versions 0 and above of TensorFlow, including versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
To fix this vulnerability, it is recommended to upgrade to TensorFlow version 2.5.0 or later. For users of affected versions still within the supported range, patches are available for versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
There is no known workaround for this vulnerability. It is recommended to apply the provided patches or upgrade to the fixed versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
