CVE-2021-41203: TensorFlow Checkpoints Loading Infrastructure Validation Bypass
Summary
CVE-2021-41203: TensorFlow is an open source platform for machine learning. Affects tensorflow-cpu across 8 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 368af875869a204b4ac552b9ddda59f6a46a56ec
< abcced051cb1bd8fb05046ac3b6023a7ebcc4578
< b619c6f865715ca3b15ef1842b5b95edbaa710ad
< e8dc63704c88007ee4713076605c90188d66f3d2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow allows users to train and save checkpoints of their models, which can be later loaded for inference or further training. Checkpoints are binary files that store the state of the model's parameters and other necessary information. These checkpoints are crucial for model persistence and reproducibility.
Vulnerability Detail
In affected versions of TensorFlow, there is a vulnerability that allows an attacker to trigger undefined behavior, integer overflows, segfaults, and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This vulnerability arises due to the lack of validation for invalid file formats in the checkpoints loading infrastructure. An attacker could exploit this vulnerability by manipulating the saved checkpoints, leading to unexpected and potentially malicious behavior. The impact of this vulnerability can range from denial of service (DoS) to potential remote code execution.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow-cpu==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow-cpu==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow-cpu==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow-cpu==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can ensure that the saved checkpoints are not accessible or modifiable by untrusted entities. This can be achieved by applying appropriate file system permissions and access controls to the directory containing the checkpoints. Additionally, it is advisable to regularly monitor the integrity of the checkpoints and verify their authenticity before loading them into TensorFlow.
Conclusion
The vulnerability in TensorFlow's checkpoints loading infrastructure poses a significant risk to the integrity and security of machine learning models. It is crucial for users to promptly update their TensorFlow installations to the fixed versions and implement appropriate security measures to protect the saved checkpoints. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source platform for machine learning that provides tools and libraries for developing and deploying machine learning models.
Checkpoints in TensorFlow are binary files that store the state of a model's parameters and other necessary information. They are used for model persistence and reproducibility.
An attacker can exploit this vulnerability by manipulating the saved checkpoints from outside of TensorFlow, triggering undefined behavior, integer overflows, segfaults, and CHECK-fail crashes.
The potential consequences of this vulnerability include denial of service (DoS) and potential remote code execution, depending on the attacker's capabilities and intentions.
To mitigate this vulnerability, it is recommended to upgrade to the latest available version of TensorFlow. Additionally, ensure that the saved checkpoints are not accessible or modifiable by untrusted entities and regularly verify their integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
