CVE-2021-29568 : Security Advisory and Response

TensorFlow, starting from version 2.1.4 and up to versions before 2.4.2, is affected by a vulnerability that allows an attacker to trigger undefined behavior by binding to a null pointer in

tf.raw_ops.ParameterizedTruncatedNormal

. This vulnerability arises due to the lack of input argument validation in the implementation. TensorFlow addressed this issue in version 2.5.0 and also applied fixes to versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

Understanding CVE-2021-29568

This section delves into the details of the CVE-2021-29568 vulnerability.

What is CVE-2021-29568?

TensorFlow, an open-source machine learning platform, allows an attacker to exploit a null pointer binding issue in

tf.raw_ops.ParameterizedTruncatedNormal

, leading to undefined behavior.

The Impact of CVE-2021-29568

With a CVSS base score of 2.5 (Low severity), this vulnerability has a high attack complexity and locally exploitable vector, with low availability impact and privileges required.

Technical Details of CVE-2021-29568

Explore the technical aspects of CVE-2021-29568 in this section.

Vulnerability Description

The vulnerability arises from the lack of input argument validation in TensorFlow's

ParameterizedTruncatedNormal

implementation, allowing attackers to bind to a null pointer.

Affected Systems and Versions

TensorFlow versions prior to 2.1.4 and up to version 2.4.2 are impacted by this vulnerability.

Exploitation Mechanism

Attackers can trigger undefined behavior by exploiting the null pointer binding in

tf.raw_ops.ParameterizedTruncatedNormal

due to unvalidated input arguments.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2021-29568 vulnerability in this section.

Immediate Steps to Take

Users are advised to update their TensorFlow installations to version 2.5.0 or apply the fixes provided for versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

Long-Term Security Practices

Implement secure coding practices, conduct regular security audits, and stay informed about TensorFlow security updates to prevent similar vulnerabilities.

Patching and Updates

Regularly check for security patches released by TensorFlow and promptly apply them to ensure your systems are protected against known vulnerabilities.