SB2021110532 - Multiple vulnerabilities in TensorFlow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021110532

SB2021110532 - Multiple vulnerabilities in TensorFlow

Published: November 5, 2021 Updated: May 4, 2026

Security Bulletin ID SB2021110532
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 33
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 70% Low 30%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 33 vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2021-41197)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in depthwise ops when processing crafted tensor inputs. A remote attacker can supply crafted filter_sizes values to trigger an assertion failure and cause a denial of service.


2) Out-of-bounds write (CVE-ID: CVE-2021-41208)

The vulnerability allows a local user to read and write outside the bounds of heap-allocated data and cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in boosted trees code in tensorflow/core/kernels/boosted_trees/stats_ops.cc when processing crafted input to boosted trees APIs. A local user can supply crafted input to trigger out-of-bounds memory access and denial of service.

The denial of service can occur through null pointer dereferences or CHECK failures.


3) Code Injection (CVE-ID: CVE-2021-41228)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to code injection in the saved_model_cli tool when processing user-supplied input expressions. A local user can supply a crafted expression string to execute arbitrary code.

User interaction is required because the CLI tool is run manually.


4) Use of Uninitialized Variable (CVE-ID: CVE-2021-41225)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of uninitialized value in Grappler optimizer auto_parallel.cc when optimizing a saved model. A remote attacker can supply a crafted saved model without a Dequeue node in the train_nodes vector to cause a denial of service.


5) Heap-based buffer overflow (CVE-ID: CVE-2021-41223)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in FusedBatchNorm kernels when processing crafted input tensors in the FusedBatchNormGrad operation. A remote attacker can supply inconsistent tensor shapes to trigger an out-of-bounds heap access and cause a denial of service.


6) Out-of-bounds read (CVE-ID: CVE-2021-41227)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ImmutableConst operation when processing a memory region as a TensorFlow string. A local user can supply a crafted memory_region_name and string type parameters to disclose sensitive information.

The issue occurs because the tstring class has a special case for memory mapped strings while the operation itself does not support this datatype.


7) Heap-based buffer overflow (CVE-ID: CVE-2021-41226)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based out-of-bounds write in the SparseBinCount implementation when processing crafted sparse bincount input. A remote attacker can supply malformed values that are not properly validated against the sparse output shape to cause a denial of service.


8) Heap-based buffer overflow (CVE-ID: CVE-2021-41224)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the SparseFillEmptyRows operation when processing input where the size of indices does not match the size of values. A remote attacker can send crafted input to cause a denial of service.


9) Input validation error (CVE-ID: CVE-2021-41222)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the SplitV operation when processing a size_splits argument containing more than one value with at least one negative value. A local user can supply crafted arguments to cause a denial of service.


10) Heap-based buffer overflow (CVE-ID: CVE-2021-41221)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the shape inference code for Cudnn* operations when processing crafted input tensors. A remote attacker can supply malformed values for the input, input_h, and input_c parameters to cause a denial of service.

The issue occurs because the ranks of these parameters are not validated before the code assumes specific dimensions.


11) NULL pointer dereference (CVE-ID: CVE-2021-41217)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the control flow graph builder when processing a model containing an Exit node that is not preceded by a paired Enter node. A remote attacker can supply a crafted TensorFlow model to cause a denial of service.


12) Division by zero (CVE-ID: CVE-2021-41218)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in the tf.raw_ops.AllToAll shape inference code when processing a crafted split_count argument. A remote attacker can supply input with split_count set to 0 to cause a denial of service.


13) Use-after-free (CVE-ID: CVE-2021-41220)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the async implementation of CollectiveReduceV2 when processing crafted input to the operation. A remote attacker can invoke the operation with crafted arguments to cause a denial of service.

The issue can also manifest as memory leaks or std::bad_alloc exceptions due to undefined behavior in error handling.


14) Heap-based buffer overflow (CVE-ID: CVE-2021-41219)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the sparse matrix multiplication kernel when processing sparse matrix multiplication with dimensions of a or b equal to 0 or less. A remote attacker can supply crafted input tensors to cause a denial of service.

The issue is triggered by the SparseMatMul raw operation.


15) Heap-based buffer overflow (CVE-ID: CVE-2021-41216)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Transpose shape inference function when processing a perm argument containing negative elements. A remote attacker can supply crafted input to trigger a heap buffer overflow and cause a denial of service.


16) Improper locking (CVE-ID: CVE-2021-41213)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of a non-reentrant lock in the tf.function API when loading a model containing mutually recursive functions and calling a recursive tf.function. A remote attacker can cause a user to load a crafted model to cause a denial of service.

This issue is triggered when two tf.function-decorated Python functions are mutually recursive.


17) NULL pointer dereference (CVE-ID: CVE-2021-41215)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the DeserializeSparse shape inference code when processing a crafted serialized_sparse input with scalar rank. A remote attacker can supply crafted input to trigger a crash and cause a denial of service.


18) NULL pointer dereference (CVE-ID: CVE-2021-41214)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to binding a reference to nullptr in the shape inference code for tf.ragged.cross when processing crafted input to the operation. A remote attacker can supply input that mixes ragged and non-ragged values to trigger a crash and cause a denial of service.


19) Out-of-bounds read (CVE-ID: CVE-2021-41212)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the shape inference code for tf.ragged.cross when processing crafted input to tf.raw_ops.RaggedCross. A remote attacker can send crafted input to trigger a heap out-of-bounds read to disclose sensitive information.


20) Out-of-bounds read (CVE-ID: CVE-2021-41211)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the QuantizeV2 shape inference code when processing a QuantizeV2 operation with a negative axis value less than -1. A remote attacker can supply a crafted axis value to cause a denial of service.


21) Out-of-bounds read (CVE-ID: CVE-2021-41205)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the shape inference functions for tf.raw_ops.QuantizeAndDequantizeV* operations when parsing input with a negative axis value other than -1. A local user can supply crafted input to trigger a heap out-of-bounds read and disclose sensitive information.

The issue is triggered when the axis argument is a negative value different from the special optional value -1.


22) Input validation error (CVE-ID: CVE-2021-41207)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ParallelConcat when parsing input. A remote attacker can supply a crafted shape value to cause a denial of service.


23) Division by zero (CVE-ID: CVE-2021-41209)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in convolution operators in tensorflow/core/kernels/conv_ops.cc when processing empty filter tensor arguments. A remote attacker can pass an empty filter tensor argument to cause a denial of service.


24) Out-of-bounds read (CVE-ID: CVE-2021-41210)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the shape inference functions for tf.raw_ops.SparseCountSparseOutput when parsing crafted input tensors. A remote attacker can supply a specially crafted indices input to disclose sensitive information.

The issue occurs because the function fails to check that the indices input has rank 2.


25) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2021-41204)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of resource tensors in Grappler constant folding when optimizing graphs. A remote attacker can trigger deep copying of a constant resource tensor to cause a denial of service.


26) Use of Uninitialized Variable (CVE-ID: CVE-2021-41201)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uninitialized variable access in EinsumHelper::ParseEquation when parsing a crafted equation. A remote attacker can supply a specially crafted equation to cause a denial of service.


27) Input validation error (CVE-ID: CVE-2021-41203)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the checkpoint loading infrastructure when parsing modified checkpoint files. A local user can supply a specially crafted checkpoint file to cause a denial of service.

Exploitation requires the ability to change saved checkpoints from outside of TensorFlow.


28) Integer overflow (CVE-ID: CVE-2021-41202)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in the tf.range kernel when calculating the size of the output for large start or limit values. A local user can supply crafted input values to cause a denial of service.


29) Integer overflow (CVE-ID: CVE-2021-41199)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tf.image.resize when processing a large size argument. A local user can supply a large size value to cause a denial of service.

The process aborts due to a CHECK failure when the output tensor size exceeds the int64_t range.


30) Integer overflow (CVE-ID: CVE-2021-41198)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in tf.tile when processing a large input argument. A remote attacker can supply a large tiling argument to cause a denial of service.

The issue results in a CHECK failure that aborts the process.


31) Input validation error (CVE-ID: CVE-2021-41200)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in tf.summary.create_file_writer when processing non-scalar arguments. A local user can pass a non-scalar argument to trigger a crash and cause a denial of service.


32) Input validation error (CVE-ID: CVE-2021-41196)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in max_pool3d when processing a pool size argument with a zero or negative dimension. A local user can supply a crafted pool_size value to cause a denial of service.


33) Integer overflow (CVE-ID: CVE-2021-41195)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tf.math.segment_* operations when processing segment_ids values. A local user can supply a large segment id to trigger a CHECK-fail related abort and cause a denial of service.

The issue affects both CPU and GPU implementations.


Remediation

Install update from vendor's website.

References