CVE-2021-41200: TensorFlow - Non-scalar Arguments Crash
Summary
CVE-2021-41200: Incomplete validation in tf.summary.create_file_writer. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41200 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research fields due to its flexibility and scalability. However, a vulnerability has been discovered in TensorFlow that can cause a crash when the tf.summary.create_file_writer function is called with non-scalar arguments.
Vulnerability Detail
The vulnerability (CVE-2021-41200) in TensorFlow arises from a CHECK-fail when the tf.summary.create_file_writer function is used with non-scalar arguments. This can lead to a crash in the code. The impact of this vulnerability can vary depending on the context in which TensorFlow is being used. In certain scenarios, an attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the execution of machine learning models.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid calling the tf.summary.create_file_writer function with non-scalar arguments. Instead, ensure that only scalar arguments are passed to the function. Here is an example of how to modify the code to avoid the vulnerability:
# Before
tf.summary.create_file_writer(non_scalar_argument)
# After
tf.summary.create_file_writer(scalar_argument)
Conclusion
In conclusion, TensorFlow is affected by a vulnerability that can cause a crash when non-scalar arguments are passed to the tf.summary.create_file_writer function. The fix for this vulnerability will be included in TensorFlow 2.7.0 and backported to older versions. Users are advised to update their installations to the latest patched version as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
The impact of this vulnerability can vary depending on the context, but it can potentially lead to a crash or disruption of machine learning model execution.
The vulnerability will be fixed in TensorFlow 2.7.0. Users should update their TensorFlow installations to the latest patched version as soon as it becomes available.
Yes, older versions such as TensorFlow 2.6.0, 2.5.0, and 2.4.4 are also affected. The fix will be backported to these versions as well.
Yes, as a temporary workaround, users can avoid passing non-scalar arguments to the tf.summary.create_file_writer function.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
