Skip to content

Missing validation during checkpoint loading

High severity GitHub Reviewed Published Nov 4, 2021 in tensorflow/tensorflow • Updated Feb 2, 2023

Package

pip tensorflow (pip)

Affected versions

>= 2.6.0, < 2.6.1
>= 2.5.0, < 2.5.2
< 2.4.4

Patched versions

2.6.1
2.5.2
2.4.4
pip tensorflow-cpu (pip)
>= 2.6.0, < 2.6.1
>= 2.5.0, < 2.5.2
< 2.4.4
2.6.1
2.5.2
2.4.4
pip tensorflow-gpu (pip)
>= 2.6.0, < 2.6.1
>= 2.5.0, < 2.5.2
< 2.4.4
2.6.1
2.5.2
2.4.4

Description

Impact

An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow.

This is because the checkpoints loading infrastructure is missing validation for invalid file formats.

Patches

We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578.

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

References

@mihaimaruseac mihaimaruseac published to tensorflow/tensorflow Nov 4, 2021
Published by the National Vulnerability Database Nov 5, 2021
Reviewed Nov 8, 2021
Published to the GitHub Advisory Database Nov 10, 2021
Last updated Feb 2, 2023

Severity

High
7.8
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CVE ID

CVE-2021-41203

GHSA ID

GHSA-7pxj-m4jf-r6h2

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.