CVE-2021-37663: TensorFlow - Incomplete Validation in QuantizeV2
Summary
CVE-2021-37663: Incomplete validation in QuantizeV2 in TensorFlow. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research fields for tasks such as image recognition, natural language processing, and recommendation systems. However, in certain versions of TensorFlow, there is a vulnerability that allows an attacker to trigger undefined behavior or access data outside the bounds of heap allocated arrays.
Vulnerability Detail
The vulnerability (CVE-2021-37663) originates from incomplete validation in the tf.raw_ops.QuantizeV2 function. The implementation of this function lacks proper validation checks for the min_range and max_range inputs. If the axis parameter is provided, the validation should also ensure that it is within the range of the input tensor's rank and that the lengths of min_range and max_range match the axis dimension of the input tensor. Without these validations, an attacker can bind a reference to a null pointer or access data beyond the allocated array bounds. This vulnerability can lead to undefined behavior, potential crashes, or unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update to the patched version of TensorFlow.
Conclusion
In conclusion, the vulnerability in TensorFlow (CVE-2021-37663) allows an attacker to trigger undefined behavior or access data outside the bounds of heap allocated arrays. It is crucial to update to the latest patched version of TensorFlow or manually apply the patch to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
The vulnerability allows an attacker to trigger undefined behavior or access data outside the bounds of heap allocated arrays, potentially leading to crashes or unauthorized access to sensitive information.
The vulnerability affects TensorFlow versions 2.3.0 to 2.3.4, 2.4.0 to 2.4.3, 2.5.0, 2.6.0-rc0, 2.6.0-rc1, and 2.6.0-rc2.
To fix the vulnerability, update to the latest patched version of TensorFlow (2.6.0) or manually apply the patch by cherry-picking the relevant commit on TensorFlow 2.5.1, 2.4.3, or 2.3.4.
No specific workaround is provided. It is recommended to update to the patched version of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
