Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

TensorFlow's Machine Learning Feature Can Cause Memory Overflow

CVE-2021-29576 · published 5 years ago
Summary

A bug in TensorFlow's machine learning platform can cause it to use too much memory, potentially leading to system crashes or security problems. This affects all versions of TensorFlow from 2.1 to 2.4. Updates are available to fix the issue, and users should apply them to stay secure.

What to do
  • Update google inc. tensorflow to version 2.1.4.
  • Update google inc. tensorflow to version 2.2.3.
  • Update google inc. tensorflow to version 2.3.3.
  • Update google inc. tensorflow to version 2.4.2.
  • Update google tensorflow-gpu to version 2.1.4.
  • Update google tensorflow-gpu to version 2.2.3.
  • Update google tensorflow-gpu to version 2.3.3.
  • Update google tensorflow-gpu to version 2.4.2.
  • Update google inc. tensorflow-cpu to version 2.1.4.
  • Update google inc. tensorflow-cpu to version 2.2.3.
  • Update google inc. tensorflow-cpu to version 2.3.3.
  • Update google inc. tensorflow-cpu to version 2.4.2.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google tensorflow-gpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google inc. tensorflow-cpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
– google tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPool3DGradGrad` is vulnerable to a heap buffer overflow. The implementation(https://githu...
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPool3DGradGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L694-L696) does not check that the initialization of `Pool3dParameters` completes successfully. Since the constructor(https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L48-L88) uses `OP_REQUIRES` to validate conditions, the first assertion that fails interrupts the initialization of `params`, making it contain invalid data. In turn, this might cause a heap buffer overflow, depending on default initialized values. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published14 May 2021
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-7cqx-92hp-x6wh · GHSA
CVE-2021-29576 · NVD
Track software like this
Free during beta