CVE-2021-29617 — MEDIUM (CVSS 5.5) AI Security Vulnerability

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be...

Full analysis pending. Showing NVD description excerpt.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	< 2.1.4	`2.1.4`
tensorflow-cpu	pip	< 2.1.4	`2.1.4`
tensorflow-gpu	pip	< 2.1.4	`2.1.4`

Severity & Risk

CVSS 3.1

5.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

KEV Status

Not in KEV

Sophistication

N/A

Recommended Action

Patch available

Update tensorflow to version 2.1.4

Update tensorflow-cpu to version 2.1.4

Update tensorflow-gpu to version 2.1.4

Compliance Impact

Compliance analysis pending. Sign in for full compliance mapping when available.

Technical Details

NVD Description

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Weaknesses (CWE)

CWE-755 Improper Handling of Exceptional Conditions Primary CWE-755

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Timeline

Published

May 14, 2021

Last Modified

November 21, 2024

First Seen

May 14, 2021