CVE-2021-29567 — MEDIUM (CVSS 5.5) AI Security Vulnerability

CISO Take

This medium-severity TensorFlow vulnerability allows local attackers to crash ML workloads by passing malformed sparse tensor inputs to SparseDenseCwiseMul — triggering assertion failures or heap out-of-bounds writes. No data exfiltration risk; impact is purely availability. Patch to TF 2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4 during routine dependency updates — treat as higher priority only if running shared multi-tenant ML platforms where untrusted users can submit tensor operations.

Risk Assessment

Risk is moderate-low in most deployment contexts. The local attack vector (AV:L) constrains exploitability to authenticated users with code execution on the TensorFlow host, eliminating most external threat actors. No confidentiality or integrity impact — CVSS availability impact is HIGH but scoped to the local process. Risk escalates meaningfully in multi-tenant environments: shared Jupyter hubs, ML pipeline submission systems, or GPU clusters where co-tenants can invoke arbitrary TensorFlow ops become viable attack surfaces. Given the 2021 publication date and availability of patches across all supported branches, unpatched exposure today reflects a dependency hygiene gap rather than a novel threat.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed today 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

5.5 / 10

EPSS

0.0%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

PATCH

Upgrade TensorFlow to 2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4 — fixes are available across all supported branches via commit 7ae2af3.
INPUT VALIDATION

If immediate upgrade is blocked, add a validation layer before SparseDenseCwiseMul calls that verifies dimension consistency between sparse indices, values, and dense shape tensors.
TF SERVING

Enable strict input signature enforcement in TF Serving model configs to reject tensors with unexpected shapes at the serving boundary.
ACCESS CONTROL

In multi-tenant environments, restrict access to tf.raw_ops APIs to trusted principals only; prefer high-level Keras/tf.sparse APIs which have additional validation.
DETECTION

Monitor ML worker processes for unexpected crash loops or OOM-adjacent terminations — repeated crashes with no other cause may indicate exploitation attempts.

Classification

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0043 - Craft Adversarial Data AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain the value of deployed AI systems

Frequently Asked Questions

What is CVE-2021-29567?

This medium-severity TensorFlow vulnerability allows local attackers to crash ML workloads by passing malformed sparse tensor inputs to SparseDenseCwiseMul — triggering assertion failures or heap out-of-bounds writes. No data exfiltration risk; impact is purely availability. Patch to TF 2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4 during routine dependency updates — treat as higher priority only if running shared multi-tenant ML platforms where untrusted users can submit tensor operations.

Is CVE-2021-29567 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2021-29567, increasing the risk of exploitation.

How to fix CVE-2021-29567?

1. PATCH: Upgrade TensorFlow to 2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4 — fixes are available across all supported branches via commit 7ae2af3. 2. INPUT VALIDATION: If immediate upgrade is blocked, add a validation layer before SparseDenseCwiseMul calls that verifies dimension consistency between sparse indices, values, and dense shape tensors. 3. TF SERVING: Enable strict input signature enforcement in TF Serving model configs to reject tensors with unexpected shapes at the serving boundary. 4. ACCESS CONTROL: In multi-tenant environments, restrict access to tf.raw_ops APIs to trusted principals only; prefer high-level Keras/tf.sparse APIs which have additional validation. 5. DETECTION: Monitor ML worker processes for unexpected crash loops or OOM-adjacent terminations — repeated crashes with no other cause may indicate exploitation attempts.

What systems are affected by CVE-2021-29567?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, shared ML compute.

What is the CVSS score for CVE-2021-29567?

CVE-2021-29567 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.01%.

Technical Details

NVD Description

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data. Since the implementation(https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80) only validates the rank of the input arguments but no constraints between dimensions(https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul), an attacker can abuse them to trigger internal `CHECK` assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Exploitation Scenario

An attacker with access to a shared Jupyter notebook environment or ML pipeline job submission interface crafts a tf.raw_ops.SparseDenseCwiseMul call where the sparse tensor's indices and values have correct rank but inconsistent dimensions relative to the dense operand. The absent bounds validation means TensorFlow's kernel proceeds with the mismatched tensors, either hitting a CHECK assertion (immediate process termination) or performing a heap write past the allocated tensor buffer. In a Kubernetes-based ML training cluster with shared namespaces, a malicious co-tenant could submit jobs that repeatedly crash the shared TF worker pool, causing autoscaler thrashing and denying GPU resources to legitimate training workloads. This requires only standard Python access to TensorFlow — no elevated privileges, no exploit development skills.