CVE-2021-37673 : Security Advisory and Response

A detailed overview of the

CHECK

-fail vulnerability in

MapStage

in TensorFlow affecting certain versions, leading to denial of service attacks.

Understanding CVE-2021-37673

This section discusses the impact, technical details, and mitigation strategies related to the vulnerability.

What is CVE-2021-37673?

TensorFlow versions >= 2.3.4 and < 2.5.1 are vulnerable to a denial of service attack through a

CHECK

-fail in

tf.raw_ops.MapStage

, allowing an attacker to exploit this flaw.

The Impact of CVE-2021-37673

The vulnerability has a CVSS base score of 5.5 (Medium severity) with a LOW attack complexity and HIGH availability impact. It does not require user interaction and affects integrity or confidentiality.

Technical Details of CVE-2021-37673

This section covers the vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The issue lies in the failure to check if the

key

input is a valid non-empty tensor in

MapStage

, potentially leading to a denial of service.

Affected Systems and Versions

Affected versions include TensorFlow >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, and < 2.3.4, which are within the supported range.

Exploitation Mechanism

An attacker can exploit this vulnerability by triggering a

CHECK

-fail in

tf.raw_ops.MapStage

, causing a denial of service.

Mitigation and Prevention

In this section, we discuss immediate steps to take, long-term security practices, and the importance of patching and updates.

Immediate Steps to Take

Users are advised to update to TensorFlow 2.6.0 to patch the vulnerability. For those on versions 2.5.1, 2.4.3, and 2.3.4, the fix has been cherrypicked.

Long-Term Security Practices

Maintaining up-to-date software versions, following secure coding practices, and regular security assessments are crucial for long-term security.

Patching and Updates

Regularly check for security advisories and apply patches as soon as they are released to mitigate risks effectively.