CVE-2021-29590: TensorFlow - Out-of-Bounds Read Vulnerability
Summary
CVE-2021-29590: Heap OOB read in TFLite's implementation of Minimum or Maximum. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29590 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research fields.
Vulnerability Detail
The Minimum and Maximum TFLite operators in TensorFlow can be exploited to read data outside the bounds of heap allocated objects. This vulnerability occurs when either of the two input tensor arguments is empty. The broadcasting implementation in the affected code does not validate the index, allowing for out-of-bounds access. An attacker could potentially leverage this vulnerability to access sensitive information or execute arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the available fix by upgrading to the patched versions of TensorFlow.
Conclusion
The out-of-bounds read vulnerability in TensorFlow can be mitigated by upgrading to the patched versions or applying the available fix. It is crucial to keep the TensorFlow installation up to date to ensure the security and integrity of machine learning models. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
This vulnerability allows for out-of-bounds read access, which can potentially lead to unauthorized access to sensitive information or arbitrary code execution.
Versions 0.x, 2.1.4, 2.2.0 - 2.2.3, 2.3.0 - 2.3.3, 2.4.0 - 2.4.2 are affected by this vulnerability.
To fix this vulnerability, upgrade to TensorFlow 2.5.0 or later. Alternatively, you can update to the patched versions for affected TensorFlow versions.
No specific workaround is provided. It is recommended to apply the available fix by upgrading to the patched versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
