CVE-2021-29611: google tensorflow Improper Initialization
Vulnerability summary
CVE-2021-29611 is a medium (CVSS 5.5) Improper Initialization vulnerability in google tensorflow. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6ea5f48415854223285/tensorflow/core/kernels/sparse_reshape_op.cc#L40) has no validation that the input arguments specify a valid sparse tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.
CVSS metrics
5 scores · 3 sources · 3 versions- CVE.orgCNA3.6LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · PypiEcosystem advisory · calculated3.6LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:LDiffers
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundTensorflow
Maturity: poc
Weaknesses
CWE · root cause- CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
PyPI3 products
- tensorflow≥ 2.3.0, < 2.3.3 | < 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6 | ≥ 2.4.0, < 2.4.2
- tensorflow-cpu≥ 2.3.0, < 2.3.3 | < 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6 | ≥ 2.4.0, < 2.4.2
- tensorflow-gpu≥ 2.3.0, < 2.3.3 | < 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6 | ≥ 2.4.0, < 2.4.2
Google1 product
- tensorflow< 2.1.4 | ≥ 2.2.0, < 2.2.3 | ≥ 2.3.0, < 2.3.3 | ≥ 2.4.0, < 2.4.2
Tensorflow1 product
- tensorflow< 2.3.3 | ≥ 2.4.0, < 2.4.2
3 vendors · 5 products
References
7 links- github.com/tensorflow/tensorflow/security/advisories/GHSA-9rpc-5v9q-5r7fX Refsource CONFIRMWEBAdvisoryExploitPatchThird Party Advisory
- github.com/tensorflow/tensorflow/commit/1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6X Refsource MISCWEBFIXPatchThird Party Advisory
