CVE-2021-41201: TensorFlow Uninitialized Variable Access
Summary
CVE-2021-41201: Unitialized access in EinsumHelper::ParseEquation. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41201 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, a vulnerability has been identified in certain versions of TensorFlow that can lead to uninitialized variable access.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41201, exists in the EinsumHelper::ParseEquation() function of TensorFlow. During execution, this function is responsible for setting flags in the input_has_ellipsis vector and *output_has_ellipsis boolean to indicate the presence of ellipsis in the corresponding inputs and output. However, the code only sets these flags to true and never assigns them false. As a result, if callers assume that EinsumHelper::ParseEquation() always sets these flags, uninitialized variable access can occur. This vulnerability can potentially be exploited by an attacker to manipulate the behavior of TensorFlow and compromise the integrity, confidentiality, and availability of machine learning models and data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by following best practices for secure software development and deployment. This includes implementing strong access controls, regularly updating dependencies, and monitoring for any suspicious activity or unexpected behavior in TensorFlow applications.
Conclusion
In conclusion, the identified vulnerability in TensorFlow can lead to uninitialized variable access, posing a risk to the integrity, confidentiality, and availability of machine learning models and data. Users are strongly advised to update their TensorFlow installations to the latest patched versions as soon as they are released. Regularly checking for updates and following best practices for secure software development and deployment is crucial to maintain the security and stability of TensorFlow deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models.
This vulnerability can lead to uninitialized variable access in TensorFlow, which can be exploited by an attacker to manipulate the behavior of machine learning models and compromise the integrity, confidentiality, and availability of data.
The vulnerability affects TensorFlow versions 2.4.4, 2.5.2, 2.6.0, and their respective patch versions.
The vulnerability will be fixed in TensorFlow 2.7.0. Users are advised to update their TensorFlow installations to the latest patched versions as soon as they become available.
There are no specific workarounds provided for this vulnerability. However, following best practices for secure software development and deployment can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
