CVE-2021-29590: TensorFlow TFLite heap out-of-bounds read in Minimum or Maximum

CVE-2021-29590 · Severity: low · CVSS 3.1 · Published 2021-05-14

TensorFlow Lite is a machine learning inference engine used to run neural network models on mobile and embedded devices. A flaw in the Minimum and Maximum operators allows an attacker to read data from outside the bounds of allocated memory when processing empty input tensors, potentially exposing sensitive information from adjacent memory regions.

Technologies: Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI), tensorflow-gpu (PyPI). Vendors: Google, PyPI.

Quick answers

Is CVE-2021-29590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-29590 being exploited in the wild.
How severe is CVE-2021-29590?
Low severity, with a CVSS score of 3.1, published 14 May 2021.
Which products and versions are affected?
Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1; Google TensorFlow Lite before 2.5.0; tensorflow (PyPI) GIT:introduced=0,fixed=953f28dca13c92839ba389c055587cfe6c723578|ECOSYSTEM:introduced=0,fixed=2.1.4,introduced=2.2.0,fixed=2.2.3,introduced=2.3.0,fixed=2.3.3,introduced=2.4.0,fixed=2.4.2; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=953f28dca13c92839ba389c055587cfe6c723578|ECOSYSTEM:introduced=0,fixed=2.1.4,introduced=2.2.0,fixed=2.2.3,introduced=2.3.0,fixed=2.3.3,introduced=2.4.0,fixed=2.4.2; and 1 more.
Is there a fix for CVE-2021-29590?
Yes. tensorflow (PyPI): upgrade to 2.4.2 or later; tensorflow-cpu (PyPI): upgrade to 2.4.2 or later; tensorflow-gpu (PyPI): upgrade to 2.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-29590 attacked?
It is attacked with local access.
Am I affected by CVE-2021-29590?
Check whether you run Google TensorFlow, Google TensorFlow Lite, tensorflow (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tensorflow (PyPI): upgrade to 2.4.2 or later
    pip install "tensorflow>=2.4.2"
  • tensorflow-cpu (PyPI): upgrade to 2.4.2 or later
    pip install "tensorflow-cpu>=2.4.2"
  • tensorflow-gpu (PyPI): upgrade to 2.4.2 or later
    pip install "tensorflow-gpu>=2.4.2"

Technical details

A heap out-of-bounds (OOB) read vulnerability exists in TensorFlow Lite's broadcasting implementation for the Minimum and Maximum operators (CWE-125). The vulnerability occurs when either of the two input tensors is empty; the broadcasting logic uses the same index to read from both input tensors without validating that the index is within bounds. An attacker can craft a model with empty tensor inputs to trigger an out-of-bounds memory read. No authentication or network access is required—only the ability to provide a malicious model to the inference engine. The vulnerability has been patched in TensorFlow 2.5.0, with backports to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

Affected products

  • Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
  • Google TensorFlow Lite before 2.5.0

Identifiers

  • CVE-2021-29590
  • GHSA-24x6-8c7m-hv3f
  • PYSEC-2021-227
  • PYSEC-2021-518
  • PYSEC-2021-716

Timeline

  • 2021-05-13: disclosed
  • 2021-05-21: advisory
  • 2021-05-21: patched: Patches released in TensorFlow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.