CVE-2021-37673: TensorFlow Denial of Service Vulnerability
Summary
CVE-2021-37673: CHECK-fail in MapStage in TensorFlow. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains.
Vulnerability Detail
The vulnerability identified as CVE-2021-37673 affects TensorFlow versions 2.3.0 to 2.6.0-rc2. It is a denial of service vulnerability that can be triggered by an attacker through a CHECK-fail in tf.raw_ops.MapStage. The implementation of this function fails to validate the key input, allowing an attacker to provide an invalid or empty tensor. This can lead to a crash or hang in the affected TensorFlow application. The issue has been patched in the GitHub commit d7de67733925de196ec8863a33445b73f9562d1d and will be included in TensorFlow 2.6.0. The fix will also be backported to TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update to the fixed versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow can be mitigated by updating to the patched versions or applying the official fix. It is crucial to keep your TensorFlow installations up to date to ensure the security and stability of your machine learning applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
The vulnerability can be exploited by an attacker to trigger a denial of service condition in TensorFlow applications, leading to crashes or hangs.
The vulnerability affects TensorFlow versions 2.3.0 to 2.6.0-rc2.
To fix this vulnerability, update your TensorFlow package to the patched versions: TensorFlow 2.6.0, TensorFlow 2.5.1, TensorFlow 2.4.3, or TensorFlow 2.3.4.
No, there is no known workaround for this vulnerability. It is recommended to apply the official patch or update to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
