CVE-2021-41198: TensorFlow - Crash due to CHECK-failure in tf.tile
Summary
CVE-2021-41198: TensorFlow is an open source platform for machine learning. Affects tensorflow across 5 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 9294094df6fea79271778eb7e7ae1bad8b5ef98f
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41198 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. It offers support for various platforms and programming languages, making it accessible to a large community of developers and researchers.
Vulnerability Detail
In affected versions of TensorFlow, a vulnerability exists in the tf.tile function. When called with a large input argument, the TensorFlow process crashes due to a CHECK-failure caused by an overflow. The number of elements in the output tensor exceeds the capacity of the int64_t type, leading to an overflow that triggers a CHECK statement. This results in the process being aborted. The vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition, disrupting the availability of TensorFlow-based applications or services. The issue has been identified and addressed by the TensorFlow development team.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerability by ensuring that the input argument provided to the tf.tile function is within the supported range. It is recommended to validate and sanitize the input data to prevent any potential overflow. Here is an example of how to validate the input argument in Python:
import tensorflow as tf
def safe_tile(input, multiples):
if tf.reduce_prod(multiples) > tf.int64.max:
raise ValueError('Input argument exceeds supported range')
return tf.tile(input, multiples)
Conclusion
In conclusion, the vulnerability in TensorFlow's tf.tile function can lead to a process crash due to an overflow. This can be exploited by an attacker to cause a denial-of-service (DoS) condition. Users are advised to update their TensorFlow installations to the latest patched version or upgrade to one of the backported versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
tf.tile is a TensorFlow function that replicates a tensor along specified dimensions.
The vulnerability can cause a TensorFlow process to crash due to an overflow, leading to a denial-of-service (DoS) condition. This can disrupt the availability of TensorFlow-based applications or services.
The vulnerability affects TensorFlow versions 2.4.4 and above, including versions 2.5.2, 2.6.1, and 2.7.0rc0.
To mitigate this vulnerability, it is recommended to update TensorFlow to the latest patched version (2.7.0) or upgrade to one of the backported versions (2.6.1, 2.5.2, or 2.4.4).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
