CVE-2021-41204: TensorFlow - Resource Tensor Deep Copy Segfault
Summary
CVE-2021-41204: Segfault while copying constant resource tensor. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41204 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow is widely used in various domains, including computer vision, natural language processing, and deep learning. However, a vulnerability has been discovered in TensorFlow that could lead to a segfault during the Grappler optimizer phase.
Vulnerability Detail
The vulnerability (CVE-2021-41204) in TensorFlow occurs when constant folding attempts to deep copy a resource tensor, which is not intended to change. This results in a segfault, potentially causing the application to crash. The issue affects versions of TensorFlow up to 2.6.0. The impact of this vulnerability can vary depending on the specific usage of TensorFlow in an application, but it has the potential to disrupt machine learning processes and affect the stability of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the available patches or update to the latest version of TensorFlow.
Conclusion
The vulnerability in TensorFlow (CVE-2021-41204) can lead to a segfault and impact the stability of the system. It is crucial to update to the latest patched version of TensorFlow or apply the available patches to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for building and deploying machine learning models.
The vulnerability can lead to a segfault during the Grappler optimizer phase in TensorFlow, potentially causing the application to crash and affecting the stability of the system.
The vulnerability affects TensorFlow versions up to 2.6.0.
To fix this vulnerability, it is recommended to update to the latest patched version of TensorFlow (2.7.0) or apply the available patches for earlier versions (2.4.4, 2.5.2, and 2.6.1).
There is no specific workaround mentioned for this vulnerability. It is recommended to update to the latest patched version of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
