CVE-2021-29609: TensorFlow Incomplete Validation in SparseAdd
Summary
CVE-2021-29609: Incomplete validation in SparseAdd. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29609 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, it is susceptible to vulnerabilities that can be exploited by attackers to compromise the integrity and security of machine learning processes.
Vulnerability Detail
The vulnerability identified as CVE-2021-29609 in TensorFlow is due to incomplete validation in the SparseAdd function. This vulnerability allows attackers to exploit undefined behavior, such as dereferencing null pointers, and write outside the bounds of heap allocated data. The SparseAdd function is responsible for adding two sparse tensors, but it fails to validate that the tensors are not empty or that the dimensions of the tensors match. This oversight enables attackers to send invalid tensor triples, which can bypass existing validation checks and exploit code assumptions that are not protected. The consequences of this vulnerability can range from crashes and memory corruption to potential remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the provided fix by updating to the patched version of TensorFlow as soon as possible.
Conclusion
The vulnerability in TensorFlow (CVE-2021-29609) exposes users to potential security risks, including crashes, memory corruption, and remote code execution. To mitigate these risks, it is crucial to update to the patched version of TensorFlow (2.5.0 or later) or apply the backported fixes in versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Regularly monitoring for vulnerabilities in open-source software, such as TensorFlow, is essential to ensure the security and integrity of machine learning processes. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive set of tools, libraries, and resources for developing and deploying machine learning models.
This vulnerability allows attackers to exploit undefined behavior and write outside the bounds of heap allocated data. It can lead to crashes, memory corruption, and potentially remote code execution.
The vulnerability affects TensorFlow versions 0 and 2.1.4 to 2.4.2. It has been fixed in TensorFlow 2.5.0 and backported to versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
No, there is no known workaround for this vulnerability. It is essential to update to the patched version of TensorFlow to mitigate the risk.
You can find more information about this vulnerability in the official TensorFlow documentation, security advisories, and the CVE entry (CVE-2021-29609).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
