CVE-2021-41206: TensorFlow - Missing Validation of Tensor Shapes
Summary
CVE-2021-41206: Incomplete validation of shapes in multiple TF ops. Affects tensorflow across 3 version ranges.
>= 2.4.0, < 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41206 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various industries and research fields for tasks such as image recognition, natural language processing, and recommendation systems. However, several versions of TensorFlow are affected by a vulnerability that involves missing validation of tensor shapes in certain operations. This vulnerability can lead to undefined behavior, crashes, and potential heap-based memory corruption.
Vulnerability Detail
The vulnerability in TensorFlow arises from the absence of shape validation for tensor arguments in certain API calls. This can result in various issues, including crashes, CHECK-fail related errors, and potential read and write operations on heap-allocated arrays. The vulnerability was discovered internally during efforts to improve and test GPU op determinism. Although no specific reproducer is available, multiple fixes for this vulnerability will be included in TensorFlow versions 2.7.0, 2.6.1, 2.5.2, and 2.4.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.0, < 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As no specific reproducer is available, there is no known workaround for this vulnerability. It is crucial to update TensorFlow to one of the patched versions to mitigate the risk of exploitation.
Conclusion
The vulnerability in TensorFlow that involves missing validation of tensor shapes can result in crashes, CHECK-fail related errors, and potential heap-based memory corruption. It is crucial to update TensorFlow to one of the patched versions (2.7.0, 2.6.1, 2.5.2, or 2.4.4) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for developing and deploying machine learning models.
The vulnerability can lead to crashes, CHECK-fail related errors, and potential heap-based memory corruption in TensorFlow applications.
The vulnerability was discovered internally during efforts to improve and test GPU op determinism.
No, only versions 2.4.0 and above are affected. The vulnerability has been patched in versions 2.4.4, 2.5.2, 2.6.1, and 2.7.0.
No, there is no known workaround. It is recommended to update TensorFlow to one of the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
