CVE-2021-29551: TensorFlow GPU - MatrixTriangularSolve Kernel Execution Termination Failure
Summary
CVE-2021-29551: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 5 version ranges.
>= 2.2.0, < 2.3.0rc0
< 2.2.0rc0
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 480641e3599775a8895254ffbc0fc45621334f68
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-29551 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. The TensorFlow GPU package, specifically, enables GPU acceleration for TensorFlow computations, enhancing performance and scalability. However, the package is susceptible to a vulnerability that affects the implementation of the MatrixTriangularSolve function.
Vulnerability Detail
The vulnerability in TensorFlow GPU arises from a flaw in the MatrixTriangularSolve implementation. When certain validation conditions fail, the kernel execution does not terminate as expected. This issue can lead to unexpected behavior and potential security risks. The vulnerability has been assigned the identifier CVE-2021-29551. It was discovered and reported by the PyPI Security Team (PYSEC). The TensorFlow development team has addressed the issue and plans to release fixes in TensorFlow versions 2.5.0, 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.0rc02.2.0rc0pip install --upgrade "tensorflow-gpu==2.2.0rc0" -
>= 2.2.0, < 2.3.0rc02.3.0rc0pip install --upgrade "tensorflow-gpu==2.3.0rc0" -
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-gpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-gpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the MatrixTriangularSolve function until they have updated to a fixed version of TensorFlow GPU. This can be achieved by modifying the code to use alternative methods or functions for matrix triangular solving. Here is an example of a possible workaround using NumPy:
import numpy as np
# Instead of using MatrixTriangularSolve
result = np.linalg.solve(matrix, vector)
Conclusion
The vulnerability in TensorFlow GPU's MatrixTriangularSolve function can result in kernel execution not terminating as expected, leading to potential security risks. It is crucial to update to a fixed version of TensorFlow GPU, such as version 2.5.0, to mitigate these risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
The TensorFlow GPU package is a specific variant of TensorFlow that enables GPU acceleration for TensorFlow computations, improving performance and scalability.
MatrixTriangularSolve is a function in TensorFlow GPU that performs matrix triangular solving, which is a common operation in linear algebra.
The vulnerability can lead to unexpected behavior and potential security risks. It is important to update to a fixed version of TensorFlow GPU to mitigate these risks.
To fix the vulnerability, update the TensorFlow GPU package to one of the fixed versions mentioned in the advisory. For example, upgrading to TensorFlow 2.5.0 will address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
