CVE-2021-41208: TensorFlow Boosted Trees API Denial of Service and Heap Buffer Overflow
Summary
CVE-2021-41208: Incomplete validation in boosted trees code. Affects tensorflow across 3 version ranges.
>= 2.4.0, < 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41208 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. The Boosted Trees API in TensorFlow allows users to train and use boosted tree models for various tasks. However, in affected versions, the Boosted Trees API lacks proper validation, which can lead to denial of service attacks, abuse of undefined behavior, and heap buffer overflows. This vulnerability can be exploited by attackers to trigger crashes, read and write from heap buffers, and potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in TensorFlow's Boosted Trees API arises from the absence of validation checks in the code. Attackers can exploit this by triggering null pointer dereferences or CHECK failures, leading to denial of service conditions. Additionally, they can abuse undefined behavior by binding references to null pointers. Depending on the API and arguments used, attackers can also read and write from heap buffers, potentially leading to information disclosure or arbitrary code execution. It is important to note that the Boosted Trees implementation in TensorFlow is unmaintained, and the affected APIs will be deprecated in future releases.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.0, < 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid using the Boosted Trees APIs in TensorFlow. Since the implementation is unmaintained and the APIs will be deprecated, it is recommended to explore alternative approaches or libraries for boosted tree models in your machine learning workflows.
Conclusion
The vulnerability in TensorFlow's Boosted Trees API can lead to denial of service attacks, abuse of undefined behavior, and potential heap buffer overflows. It is crucial to upgrade to the fixed versions of TensorFlow or apply the recommended workarounds to ensure the security and stability of your machine learning models. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning, providing tools and libraries for building and deploying machine learning models.
The Boosted Trees API in TensorFlow allows users to train and use boosted tree models for various machine learning tasks.
This vulnerability can lead to denial of service attacks, abuse of undefined behavior, and potential heap buffer overflows. Attackers can trigger crashes, read and write from heap buffers, and potentially execute arbitrary code.
To fix this vulnerability, upgrade to TensorFlow 2.7.0 or later. Alternatively, you can upgrade to TensorFlow 2.6.1, 2.5.2, or 2.4.4 if you are within the supported range.
No, it is recommended to avoid using the Boosted Trees APIs in TensorFlow due to the vulnerability and the fact that the implementation is unmaintained. Consider exploring alternative approaches or libraries for boosted tree models.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
