PT-2021-23198 · Google · Tensorflow

Qian Feng · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41225

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow version 2.6.1 TensorFlow version 2.5.2 TensorFlow version 2.4.4

Description TensorFlow's Grappler optimizer has a use of an uninitialized variable. If the train nodes vector does not contain a Dequeue node, then dequeue node is left uninitialized.

Recommendations For TensorFlow versions prior to 2.7.0, update to version 2.7.0 or later. For TensorFlow version 2.6.1, update to a version that includes the cherrypicked commit. For TensorFlow version 2.5.2, update to a version that includes the cherrypicked commit. For TensorFlow version 2.4.4, update to a version that includes the cherrypicked commit. As a temporary workaround, consider disabling the Grappler optimizer until a patch is available.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

BIT-TENSORFLOW-2021-41225

CVE-2021-41225

GHSA-7R94-XV9V-63JW

OPENSUSE-SU-2024:12116-1

PYSEC-2021-417

PYSEC-2021-634

PYSEC-2021-832

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw · Exploit
• https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41225 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-832 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41225 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-634 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-417 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7r94-xv9v-63jw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41225 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-417.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-634.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-832.yaml · Note
• https://t.me/cibsecurity/31925 · Telegram Post