CVE-2021-29605: TensorFlow TFLite Integer Overflow Vulnerability
Summary
CVE-2021-29605: Integer overflow in TFLite memory allocation. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29605 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow Lite (TFLite) is a lightweight version of TensorFlow designed for mobile and embedded devices. TFLite allows developers to run machine learning models on resource-constrained platforms. However, a vulnerability has been discovered in the TFLite code that handles the allocation of TFLiteIntArray objects.
Vulnerability Detail
The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issue. This vulnerability arises from an integer multiplication that can result in a value that exceeds the maximum representable value for the int data type. When this occurs, the resulting value becomes negative, leading to an invalid pointer dereference when passed to the malloc function. An attacker can exploit this vulnerability by crafting a malicious model that triggers the integer overflow, potentially leading to a denial of service or arbitrary code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is necessary to apply the official fix by updating to the patched version of TensorFlow.
Conclusion
The TensorFlow TFLite Integer Overflow Vulnerability (CVE-2021-29605) poses a risk to systems running vulnerable versions of TensorFlow. To mitigate this vulnerability, it is crucial to update TensorFlow installations to the latest patched version as soon as it becomes available. Regularly checking for updates and promptly applying them is recommended to ensure the security of TensorFlow deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools, libraries, and resources for building and deploying machine learning models.
TensorFlow Lite (TFLite) is a lightweight version of TensorFlow designed for running machine learning models on resource-constrained platforms, such as mobile and embedded devices.
This vulnerability can be exploited by an attacker to trigger a denial of service or potentially execute arbitrary code on systems running vulnerable versions of TensorFlow.
To fix this vulnerability, users should update their TensorFlow installations to the latest patched version as soon as it becomes available. The fix has been backported to earlier versions, including TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.
No workaround has been provided for this vulnerability. It is necessary to apply the official fix by updating to the patched version of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
