CVE-2021-37648: TensorFlow - Null Pointer Dereference in tf.raw_ops.SaveV2
Summary
CVE-2021-37648: Incorrect validation of SaveV2 inputs in TensorFlow. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37648 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been discovered in TensorFlow that can lead to a null pointer dereference.
Vulnerability Detail
The vulnerability (CVE-2021-37648) exists in the code for tf.raw_ops.SaveV2 in TensorFlow. The implementation of ValidateInputs in the affected versions does not properly validate the inputs, allowing an attacker to trigger a null pointer dereference. This can lead to a crash or potentially be exploited for remote code execution. The issue has been patched in the latest versions of TensorFlow, and the fix will be included in TensorFlow 2.6.0. The vulnerability affects TensorFlow versions 2.3.0 to 2.6.0-rc2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to avoid using the tf.raw_ops.SaveV2 function in the affected versions of TensorFlow. Instead, users can use an alternative method for saving models or consider upgrading to the patched version once it is available.
Conclusion
In conclusion, the vulnerability (CVE-2021-37648) in TensorFlow can lead to a null pointer dereference, potentially resulting in a crash or remote code execution. It is recommended to update to the latest patched version (2.6.0) once it is released or apply the available patches for the affected versions. Users can also use Vulert's playground to check if their application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for building and deploying machine learning models.
A null pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer, resulting in a crash or undefined behavior.
The vulnerability can be exploited by an attacker who can provide malicious inputs to the tf.raw_ops.SaveV2 function, triggering a null pointer dereference. This can potentially lead to a crash or be used for remote code execution.
The vulnerability affects TensorFlow versions 2.3.0 to 2.6.0-rc2. Users of these versions should apply the available patches or upgrade to the latest patched version once it is released.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
