PT-2021-23186 · Google · Tensorflow

Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41213

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description The code behind the tf.function API can be made to deadlock when two tf.function decorated Python functions are mutually recursive. This occurs due to using a non-reentrant Lock Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive tf.function, although this is not a frequent scenario.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider avoiding the use of mutually recursive functions with the tf.function API until a patch is available.

Fix

Improper Locking

Weakness Enumeration

CWE-662

CWE-667

Related Identifiers

BIT-TENSORFLOW-2021-41213

CVE-2021-41213

GHSA-H67M-XG8F-FXCF

OPENSUSE-SU-2024:12116-1

PYSEC-2021-405

PYSEC-2021-622

PYSEC-2021-820

Affected Products

Tensorflow

References · 14

• https://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7 · Patch
• https://osv.dev/vulnerability/GHSA-h67m-xg8f-fxcf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-622 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41213 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-405 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41213 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h67m-xg8f-fxcf · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-405.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-622.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-820.yaml · Note
• https://t.me/cibsecurity/31938 · Telegram Post