CVE-2021-29584: TensorFlow Integer Overflow Denial of Service
Summary
CVE-2021-29584: CHECK-fail due to integer overflow. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29584 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow is widely used in various industries and research fields due to its flexibility and scalability. However, a vulnerability has been discovered in TensorFlow that can be exploited to trigger a denial of service attack.
Vulnerability Detail
The vulnerability in TensorFlow is caused by an integer overflow when constructing a new tensor shape. This occurs in the implementation of the sparse_split_op.cc file, where a dense shape is built without proper checks for overflow. The TensorShape constructor uses a CHECK operation, which triggers when the dimensions result in an overflow. An attacker can exploit this vulnerability to cause a denial of service by triggering the CHECK-failure. The impact of this vulnerability can be severe, as it can lead to the disruption of machine learning processes and potentially affect the availability of the TensorFlow system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended action is to apply the available fixes by upgrading to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow that allows for an integer overflow denial of service attack has been addressed in the latest release and backported to previous versions. It is crucial for users of TensorFlow to update their installations to the patched versions to ensure the security and stability of their systems. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
The vulnerability can be exploited to trigger a denial of service attack, potentially disrupting machine learning processes and affecting the availability of the TensorFlow system.
To fix this vulnerability, it is recommended to upgrade to TensorFlow 2.5.0 or later. Alternatively, you can update to one of the backported fixes in TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, or TensorFlow 2.1.4.
No specific workaround is provided for this vulnerability. It is recommended to apply the available fixes by upgrading to the patched versions of TensorFlow.
For more information about this vulnerability, you can refer to the official TensorFlow documentation or contact the TensorFlow development team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
