CVE-2021-41225: A use of uninitialized value vulnerability in Tensorflow
Impact TensorFlow's Grappler optimizer has a use of unitialized variable:
cc const NodeDef dequeuenode; for (const auto& trainnode : trainnodes) { if (IsDequeueOp(trainnode)) { dequeuenode = trainnode; break; } }
if (dequeuenode) { ... }
If the trainnodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeuenode is left unitialized.
Patches We have patched the issue in GitHub commit 68867bf01239d9e1048f98cbad185bf4761bedd3.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Qian Feng from Baidu Security Team.
Other sources
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the trainnodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeuenode is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What does CVE-2021-41225 refer to?
CVE-2021-41225 refers to a use of uninitialized variable vulnerability in TensorFlow's Grappler optimizer.
What versions of TensorFlow are affected by CVE-2021-41225?
CVE-2021-41225 affects TensorFlow versions between 2.4.0 and 2.4.4, versions between 2.6.0 and 2.6.1, as well as specific release candidates 2.7.0-rc0 and 2.7.0-rc1.
How can I fix the vulnerability identified by CVE-2021-41225?
To fix CVE-2021-41225, upgrade TensorFlow to versions 2.4.4, 2.5.2, or 2.6.1.
What is the potential impact of CVE-2021-41225?
The impact of CVE-2021-41225 could lead to unpredictable behavior or crashes in applications relying on the affected versions of TensorFlow.
Is there a known exploitation for CVE-2021-41225?
As of now, there are no publicly known exploits targeting CVE-2021-41225, but it is advisable to patch affected versions to mitigate risk.