CVE-2021-41203
published 2021-11-05CVE-2021-41203: TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.0th percentile
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | < 2.4.4 | 2.4.4 | |
| tensorflow | >= 2.5.0 < 2.5.2 | 2.5.2 | |
| tensorflow | >= 2.6.0 < 2.6.1 | 2.6.1 | |
| intel | optimization_for_tensorflow | < abcced051cb1bd8fb05046ac3b6023a7ebcc4578 | abcced051cb1bd8fb05046ac3b6023a7ebcc4578 |
| intel | optimization_for_tensorflow | < e8dc63704c88007ee4713076605c90188d66f3d2 | e8dc63704c88007ee4713076605c90188d66f3d2 |
| intel | optimization_for_tensorflow | < b619c6f865715ca3b15ef1842b5b95edbaa710ad | b619c6f865715ca3b15ef1842b5b95edbaa710ad |
| intel | optimization_for_tensorflow | >= 0 < 2.4.4 | 2.4.4 |
| intel | optimization_for_tensorflow | >= 0 < 368af875869a204b4ac552b9ddda59f6a46a56ec | 368af875869a204b4ac552b9ddda59f6a46a56ec |
| intel | optimization_for_tensorflow | >= 2.5.0 < 2.5.2 | 2.5.2 |
| intel | optimization_for_tensorflow | >= 2.6.0 < 2.6.1 | 2.6.1 |
| intel | optimization_for_tensorflow | >= 2.7.0rc0 < 2.7.0 | 2.7.0 |
| tensorflow | tensorflow | < 2.4.4 | 2.4.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2021-41203: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...
vendor_debian·2021·CVSS 7.8
CVE-2021-41203 [HIGH] CVE-2021-41203: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Scope: local
forky: resolved
sid: resolved
OSV
Missing validation during checkpoint loading
osv·2021-11-10
CVE-2021-41203 [HIGH] Missing validation during checkpoint loading
Missing validation during checkpoint loading
### Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow.
This is because the checkpoints loading infrastructure is missing validation for invalid file formats.
### Patches
We have patched the issue in GitHub commits [b619c6f865715ca3b15ef1842b5b95edbaa710ad](https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad), [e8dc63704c88007ee4713076605c90188d66f3d2](https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2), [368af875869a204b4ac552b9ddda59f6a46a56ec](https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec), and [abcced051cb1
GHSA
Missing validation during checkpoint loading
ghsa·2021-11-10
CVE-2021-41203 [HIGH] CWE-190 Missing validation during checkpoint loading
Missing validation during checkpoint loading
### Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow.
This is because the checkpoints loading infrastructure is missing validation for invalid file formats.
### Patches
We have patched the issue in GitHub commits [b619c6f865715ca3b15ef1842b5b95edbaa710ad](https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad), [e8dc63704c88007ee4713076605c90188d66f3d2](https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2), [368af875869a204b4ac552b9ddda59f6a46a56ec](https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec), and [abcced051cb1
OSV
CVE-2021-41203: TensorFlow is an open source platform for machine learning
osv·2021-11-05
CVE-2021-41203 CVE-2021-41203: TensorFlow is an open source platform for machine learning
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56echttps://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710adhttps://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7pxj-m4jf-r6h2https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56echttps://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710adhttps://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7pxj-m4jf-r6h2
2021-11-05
Published