CVE-2021-41227: TensorFlow - Arbitrary Memory Read Vulnerability
Summary
CVE-2021-41227: Arbitrary memory read in ImmutableConst. Affects tensorflow across 3 version ranges.
>= 2.4.0, < 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. It offers support for various programming languages and platforms, making it accessible and versatile for developers. However, a vulnerability has been identified in TensorFlow that allows for arbitrary memory read, potentially leading to unauthorized access and information disclosure.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41227, resides in the ImmutableConst operation of TensorFlow. It arises from a special case handling of memory mapped strings in the tstring TensorFlow string class, without proper support in the operation itself. This flaw can be exploited to trick the ImmutableConst operation into reading arbitrary memory contents. An attacker could leverage this vulnerability to access sensitive information, such as cryptographic keys, authentication tokens, or other confidential data stored in memory. The impact of this vulnerability can be significant, potentially leading to unauthorized access, data leakage, and further exploitation of the compromised system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.0, < 2.4.42.4.4 -
>= 2.5.0, < 2.5.22.5.2 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. However, users can consider implementing general security best practices to minimize the risk of exploitation. These practices may include restricting access to vulnerable systems, implementing strong access controls, regularly monitoring and auditing system activity, and applying security patches and updates promptly. It is recommended to consult the official TensorFlow documentation and security resources for additional guidance on securing TensorFlow installations.
Conclusion
The vulnerability in TensorFlow, identified as CVE-2021-41227, poses a risk of arbitrary memory read and unauthorized access. It is crucial for users to update their TensorFlow installations to the latest patched version as soon as it becomes available. By staying up to date with security patches and following best practices, users can ensure the integrity and security of their machine learning workflows and applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
The vulnerability allows for arbitrary memory read in TensorFlow, potentially leading to unauthorized access and information disclosure. It can be exploited to access sensitive data stored in memory.
The vulnerability affects TensorFlow versions 2.4.0 to 2.4.4, 2.5.0 to 2.5.2, 2.6.0 to 2.6.1, and 2.7.0-rc0 to 2.7.0-rc1.
Yes, the TensorFlow development team has addressed the vulnerability in TensorFlow 2.7.0 and backported the fix to earlier versions within the supported range.
To protect your TensorFlow installation, it is recommended to update to the latest patched version as soon as it becomes available. Follow the official upgrade instructions provided by TensorFlow and implement general security best practices.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
