CVE-2021-37678: TensorFlow - Arbitrary Code Execution when Deserializing Keras Model from YAML Format
Summary
CVE-2021-37678: Arbitrary code execution due to YAML deserialization. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37678 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow includes a high-level API called Keras, which simplifies the process of building and training deep learning models. Keras models can be serialized and saved in YAML format for later use. However, a vulnerability in TensorFlow and Keras allows an attacker to execute arbitrary code when deserializing a Keras model from YAML format.
Vulnerability Detail
The vulnerability arises from the use of yaml.unsafe_load in the implementation of deserializing Keras models from YAML format. This function can execute arbitrary code provided as input, leading to potential remote code execution. An attacker could craft a malicious YAML file that, when deserialized, triggers the execution of arbitrary code on the target system. This could result in unauthorized access, data leakage, or further compromise of the affected machine. The vulnerability has been patched in TensorFlow 2.6.0 and backported to earlier versions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid deserializing Keras models from YAML format until the vulnerability is fixed. Instead, consider using alternative serialization formats or storing the models in a secure manner. Additionally, it is crucial to validate and sanitize any user-supplied input to prevent the execution of arbitrary code.
Conclusion
The vulnerability in TensorFlow and Keras allows for arbitrary code execution when deserializing Keras models from YAML format. It is crucial to update TensorFlow to the latest version or apply the provided patches to mitigate the risk. Regularly updating dependencies and following secure coding practices can help prevent similar vulnerabilities in the future. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem of tools and libraries.
Keras is a high-level API in TensorFlow that simplifies the process of building and training deep learning models.
The vulnerability arises from the use of yaml.unsafe_load when deserializing Keras models from YAML format, allowing for arbitrary code execution.
The vulnerability could lead to unauthorized access, data leakage, or further compromise of the affected system.
To fix the vulnerability, update TensorFlow to version 2.6.0 or apply the available patches for earlier versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
