Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

TensorFlow's Machine Learning Function Can Crash with Empty Data

CVE-2021-29583 · published 5 years ago
Summary

A security issue in TensorFlow's machine learning function can cause a program to crash if it's given empty data. This can happen when the function tries to process data that is missing some important information. To stay safe, update TensorFlow to version 2.5.0 or apply a patch to versions 2.4.2, 2.3.3, 2.2.3, or 2.1.4 if you're already using one of those versions.

What to do
  • Update google inc. tensorflow to version 2.1.4.
  • Update google inc. tensorflow to version 2.2.3.
  • Update google inc. tensorflow to version 2.3.3.
  • Update google inc. tensorflow to version 2.4.2.
  • Update google tensorflow-gpu to version 2.1.4.
  • Update google tensorflow-gpu to version 2.2.3.
  • Update google tensorflow-gpu to version 2.3.3.
  • Update google tensorflow-gpu to version 2.4.2.
  • Update google inc. tensorflow-cpu to version 2.1.4.
  • Update google inc. tensorflow-cpu to version 2.2.3.
  • Update google inc. tensorflow-cpu to version 2.3.3.
  • Update google inc. tensorflow-cpu to version 2.4.2.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google tensorflow-gpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google inc. tensorflow-cpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
– google tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same ...
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation(https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc) fails to validate that `scale`, `offset`, `mean` and `variance` (the last two only when required) all have the same number of elements as the number of channels of `x`. This results in heap out of bounds reads when the buffers backing these tensors are indexed past their boundary. If the tensors are empty, the validation mentioned in the above paragraph would also trigger and prevent the undefined behavior. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
CWE-476NULL Pointer Dereference
CWE-787Out-of-bounds Write
Timeline
Published14 May 2021
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-9xh4-23q4-v6wr · GHSA
CVE-2021-29583 · NVD
Track software like this
Free during beta