CVE-2021-29616: TensorFlow - Null Pointer Dereference in TrySimplify
Summary
CVE-2021-29616: Null dereference in Grappler's TrySimplify. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29616 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been discovered in TensorFlow that can lead to a null pointer dereference in the TrySimplify function of the arithmetic optimizer. This vulnerability can be exploited in certain corner cases where a node with no inputs is optimized. The issue affects multiple versions of TensorFlow, including 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
Vulnerability Detail
The vulnerability arises from the implementation of the TrySimplify function in TensorFlow's arithmetic optimizer. In specific scenarios where a node with no inputs is being optimized, the function may dereference a null pointer, resulting in undefined behavior. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) or execute arbitrary code within the context of the affected TensorFlow application. The impact of this vulnerability can range from service disruption to potential data compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As this vulnerability is addressed in the fixed versions of TensorFlow, there is no specific workaround available. It is crucial to update to the patched versions to ensure the security and stability of the TensorFlow application.
Conclusion
The vulnerability in TensorFlow, which can lead to a null pointer dereference in the TrySimplify function, has been addressed by the TensorFlow development team. It is crucial for users to update their TensorFlow installations to the fixed versions (2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4) to ensure the security and stability of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive set of tools and libraries for developing and deploying machine learning models.
This vulnerability can lead to a null pointer dereference in TensorFlow, potentially resulting in a denial of service or arbitrary code execution.
The vulnerability affects TensorFlow versions 2.1.4, 2.2.3, 2.3.3, and 2.4.2.
To fix this vulnerability, it is recommended to update the TensorFlow package to one of the fixed versions (2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4) as soon as they become available.
The fixed versions of TensorFlow can be obtained from the official TensorFlow repository or through package managers like pip.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
