Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

TensorFlow Crashes When Using Certain Machine Learning Function

CVE-2021-29618 · published 5 years ago
Summary

TensorFlow's machine learning platform crashes when a complex argument is passed to a specific function in a particular way. This can cause the software to stop working unexpectedly, which can disrupt business operations. Affected users should update to the latest version of TensorFlow to prevent crashes.

What to do
  • Update google inc. tensorflow to version 2.1.4.
  • Update google inc. tensorflow to version 2.2.3.
  • Update google inc. tensorflow to version 2.3.3.
  • Update google inc. tensorflow to version 2.4.2.
  • Update google tensorflow-gpu to version 2.1.4.
  • Update google tensorflow-gpu to version 2.2.3.
  • Update google tensorflow-gpu to version 2.3.3.
  • Update google tensorflow-gpu to version 2.4.2.
  • Update google inc. tensorflow-cpu to version 2.1.4.
  • Update google inc. tensorflow-cpu to version 2.2.3.
  • Update google inc. tensorflow-cpu to version 2.3.3.
  • Update google inc. tensorflow-cpu to version 2.4.2.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google tensorflow-gpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
pip google inc. tensorflow-cpu < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fix: upgrade to 2.1.4
– google tensorflow < 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix...
TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published14 May 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xqfj-cr6q-pc8w · GHSA
CVE-2021-29618 · NVD
Track software like this
Free during beta