CVE-2021-41203: TensorFlow GPU Checkpoint Loading Infrastructure Vulnerability
Summary
CVE-2021-41203: TensorFlow is an open source platform for machine learning. Affects tensorflow-gpu across 8 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 368af875869a204b4ac552b9ddda59f6a46a56ec
< abcced051cb1bd8fb05046ac3b6023a7ebcc4578
< b619c6f865715ca3b15ef1842b5b95edbaa710ad
< e8dc63704c88007ee4713076605c90188d66f3d2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-41203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It is widely used in various domains, including research, industry, and academia. TensorFlow allows users to save and load checkpoints, which are serialized representations of the model's parameters and other important information. These checkpoints are crucial for resuming training, performing inference, and transferring models across different environments. However, the checkpoint loading infrastructure in TensorFlow is vulnerable to manipulation of saved checkpoints from outside the framework.
Vulnerability Detail
The vulnerability in TensorFlow's checkpoint loading infrastructure arises from the lack of validation for invalid file formats. An attacker who can modify the saved checkpoints can trigger undefined behavior, integer overflows, segmentation faults, and CHECK-fail crashes. This can lead to various security issues, including denial-of-service (DoS) attacks, information disclosure, and potential remote code execution. The impact of this vulnerability depends on the context in which TensorFlow is used and the privileges of the user running TensorFlow. The affected versions include TensorFlow 2.4.4, 2.5.2, 2.6.1, and 2.7.0rc0.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow-gpu==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow-gpu==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow-gpu==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow-gpu==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can ensure that the saved checkpoints are not accessible to untrusted entities. This can be achieved by applying appropriate file system permissions and access controls to the directory where the checkpoints are stored. Additionally, it is recommended to monitor the integrity of the saved checkpoints and verify their authenticity before loading them into TensorFlow. This can be done by implementing a checksum or digital signature mechanism for the checkpoints.
Conclusion
The vulnerability in TensorFlow's checkpoint loading infrastructure can be mitigated by updating to the fixed versions of TensorFlow. It is crucial to keep software dependencies up to date to ensure the security and stability of machine learning applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
A checkpoint in TensorFlow is a serialized representation of a model's parameters and other important information. It is used for resuming training, performing inference, and transferring models across different environments.
The impact of this vulnerability depends on the context in which TensorFlow is used and the privileges of the user running TensorFlow. It can lead to security issues such as denial-of-service (DoS) attacks, information disclosure, and potential remote code execution.
The vulnerability affects TensorFlow versions 2.4.4, 2.5.2, 2.6.1, and 2.7.0rc0.
To fix the vulnerability, users should update their TensorFlow installation to one of the fixed versions: TensorFlow 2.7.0, TensorFlow 2.6.1, TensorFlow 2.5.2, or TensorFlow 2.4.4.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
