CVE-2021-37673: TensorFlow MapStage denial of service via CHECK-fail

CVE-2021-37673 · Severity: low · CVSS 3.1 · Published 2021-08-12

TensorFlow is a widely-used machine learning framework for building and training neural networks. An attacker can crash any TensorFlow application by calling the MapStage operation with malformed inputs, causing the application to terminate abnormally. This could disrupt machine learning services or batch processing pipelines that rely on TensorFlow.

Technologies: Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI), tensorflow-gpu (PyPI). Vendors: Google, PyPI.

Quick answers

Is CVE-2021-37673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-37673 being exploited in the wild.
How severe is CVE-2021-37673?
Low severity, with a CVSS score of 3.1, published 12 August 2021.
Which products and versions are affected?
Google TensorFlow 0.12.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0; tensorflow (PyPI) GIT:introduced=0,fixed=d7de67733925de196ec8863a33445b73f9562d1d|ECOSYSTEM:introduced=2.3.0,fixed=2.3.4,introduced=2.4.0,fixed=2.4.3; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=d7de67733925de196ec8863a33445b73f9562d1d|ECOSYSTEM:introduced=2.3.0,fixed=2.3.4,introduced=2.4.0,fixed=2.4.3; tensorflow-gpu (PyPI) GIT:introduced=0,fixed=d7de67733925de196ec8863a33445b73f9562d1d|ECOSYSTEM:introduced=2.3.0,fixed=2.3.4,introduced=2.4.0,fixed=2.4.3.
Is there a fix for CVE-2021-37673?
Yes. tensorflow (PyPI): upgrade to 2.4.3 or later; tensorflow-cpu (PyPI): upgrade to 2.4.3 or later; tensorflow-gpu (PyPI): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-37673 attacked?
It is attacked with local access.
Am I affected by CVE-2021-37673?
Check whether you run Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tensorflow (PyPI): upgrade to 2.4.3 or later
    pip install "tensorflow>=2.4.3"
  • tensorflow-cpu (PyPI): upgrade to 2.4.3 or later
    pip install "tensorflow-cpu>=2.4.3"
  • tensorflow-gpu (PyPI): upgrade to 2.4.3 or later
    pip install "tensorflow-gpu>=2.4.3"

Technical details

The vulnerability exists in tf.raw_ops.MapStage, which fails to validate that the key input is a valid non-empty tensor. When called with an empty tensor (shape [0, 0, 0, 0]), the operation triggers a CHECK failure that terminates the process. This is an input validation weakness (CWE-20). The attack requires no authentication and can be triggered by any code with access to TensorFlow APIs, making it exploitable via local execution or remote code execution if the application exposes TensorFlow operations. The fix adds proper input validation and was patched in TensorFlow 2.6.0, with backports to 2.5.1, 2.4.3, and 2.3.4.

Affected products

  • Google TensorFlow 0.12.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0
  • Google TensorFlow CPU 1.15.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0
  • Google TensorFlow GPU 0.12.0 through 2.3.3, 2.4.0 through 2.4.2, 2.5.0

Identifiers

  • CVE-2021-37673
  • GHSA-278g-rq84-9hmg
  • PYSEC-2021-295
  • PYSEC-2021-586
  • PYSEC-2021-784

Timeline

  • 2021-08-11: disclosed
  • 2021-08-25: patched: Patches released for TensorFlow 2.3.4, 2.4.3, 2.5.1, and 2.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.