CVE-2021-41213 : Security Advisory and Response

TensorFlow is an open-source machine learning platform. In affected versions, a deadlock can occur in mutually recursive

tf.function

objects due to improper locking. An attacker can exploit this to cause denial of service.

Understanding CVE-2021-41213

In this CVE, a vulnerability in TensorFlow allows for deadlock creation in mutually recursive

tf.function

objects, potentially leading to a denial of service attack.

What is CVE-2021-41213?

TensorFlow, a popular machine learning platform, is vulnerable to deadlock generation within mutually recursive

tf.function

objects, caused by improper locking mechanisms. This flaw can be exploited to trigger a denial of service attack.

The Impact of CVE-2021-41213

CVSS Score: 5.5 (Medium)
Attack Vector: Local
Availability Impact: High
Privileges Required: Low
Scope: Unchanged
The vulnerability poses a medium-severity risk, allowing attackers to disrupt the availability of affected TensorFlow models.

Technical Details of CVE-2021-41213

The following technical details shed light on the vulnerability in TensorFlow:

Vulnerability Description

The issue lies in the usage of a non-reentrant

Lock

Python object in mutually recursive

tf.function

Python functions.
Loading models containing such functions can trigger deadlock, leading to denial of service.

Affected Systems and Versions

TensorFlow versions >= 2.6.0 and < 2.6.1
TensorFlow versions >= 2.5.0 and < 2.5.2
TensorFlow versions < 2.4.4

Exploitation Mechanism

Attackers can exploit this vulnerability by inducing users to load affected models and execute recursive

tf.function

calls, resulting in deadlock scenarios.

Mitigation and Prevention

Here are the steps to mitigate the risks associated with CVE-2021-41213:

Immediate Steps to Take

Update TensorFlow to version 2.7.0 or apply patches available for versions 2.6.1, 2.5.2, and 2.4.4.
Avoid loading models containing mutually recursive functions in TensorFlow.

Long-Term Security Practices

Regularly monitor and apply security updates provided by TensorFlow.
Implement secure coding practices, especially in handling concurrency and locking mechanisms.

Patching and Updates

Ensure all affected systems are updated to TensorFlow 2.7.0 or apply the necessary patches to mitigate the vulnerability efficiently.