CVE-2021-29610: TensorFlow - Invalid Axis Argument Validation Vulnerability
Summary
CVE-2021-29610: Invalid validation in QuantizeAndDequantizeV2. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29610 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various industries and research fields.
Vulnerability Detail
The vulnerability exists in the tf.raw_ops.QuantizeAndDequantizeV2 function of TensorFlow. The validation for the axis argument in this function allows invalid values. The validation logic uses a mixed condition with the || operator, which leads to a heap underflow when axis_ < -1. This allows attackers to read/write to other data on the heap, potentially leading to unauthorized access or data corruption.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to wait for the official fix and update TensorFlow to the latest version as soon as it is released.
Conclusion
The vulnerability in TensorFlow's tf.raw_ops.QuantizeAndDequantizeV2 function allows for an invalid axis argument, leading to a heap underflow and potential unauthorized access or data corruption. It is important to update to the latest version of TensorFlow once the fix is available to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning, providing tools and resources for building and deploying machine learning models.
This vulnerability allows attackers to read/write to other data on the heap, potentially leading to unauthorized access or data corruption.
The vulnerability affects TensorFlow versions 0 and 2.1.4 to 2.4.2. Users of these versions should update to the latest version once the fix is available.
Currently, there is no known workaround for this vulnerability. It is advised to wait for the official fix and update TensorFlow to the latest version as soon as it is released.
For more information about this vulnerability, you can refer to the official TensorFlow security advisories and release notes.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
