CVE-2021-41226: TensorFlow - Heap Out-of-Bounds Access in SparseBinCount
Summary
CVE-2021-41226: Heap OOB read in SparseBinCount. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41226 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been identified in TensorFlow that affects certain versions of the package.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41226, is related to the implementation of SparseBinCount in TensorFlow. It arises due to the absence of proper validation between the elements of the values argument and the shape of the sparse output. This flaw can lead to a heap out-of-bounds access, potentially resulting in a variety of security issues, such as information disclosure or remote code execution. The vulnerability has been assigned a severity rating of High.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. The recommended course of action is to apply the available patches or update to the fixed versions of TensorFlow.
Conclusion
In conclusion, TensorFlow is susceptible to a heap out-of-bounds access vulnerability in the SparseBinCount implementation. This vulnerability can have serious security implications and should be addressed by updating to the fixed versions of TensorFlow. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for building and deploying machine learning models.
The vulnerability can lead to a heap out-of-bounds access, which may result in security issues such as information disclosure or remote code execution.
The vulnerability affects TensorFlow versions 2.4.4, 2.5.2, 2.6.1, and any earlier versions within the supported range.
To fix this vulnerability, update your TensorFlow installation to one of the fixed versions: TensorFlow 2.7.0, TensorFlow 2.6.1, TensorFlow 2.5.2, or TensorFlow 2.4.4.
No specific workaround has been provided. It is recommended to apply the available patches or update to the fixed versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
