VIR Vulnerability Intelligence Relay

CVE-2021-29611

critical
Published 2021-05-21 · Modified 2023-12-06
CVSS v3
—
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v2
—
VIR risk
9.5

Description

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6ea5f48415854223285/tensorflow/core/kernels/sparse_reshape_op.cc#L40) has no validation that the input arguments specify a valid sparse tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-29611

OS impact
OSVersionStatusFixed in
arch archfixed2.5.0-1
debian debianforkyfixed0
debian debiansidfixed0

Package impact
EcosystemPackageVulnerableFixed
python PyPItensorflow>=2.3.0,<2.3.32.3.3
python PyPItensorflow>=2.4.0,<2.4.22.4.2
python PyPItensorflow-cpu>=2.3.0,<2.3.32.3.3
python PyPItensorflow-cpu>=2.4.0,<2.4.22.4.2
python PyPItensorflow-gpu>=2.3.0,<2.3.32.3.3
python PyPItensorflow-gpu>=2.4.0,<2.4.22.4.2
python PyPItensorflow-cpu<1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6||>=2.4.0,<2.4.21d04d7d93f4ed3854abf75d6b712d72c3f70d6b6
python PyPItensorflow<1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6||>=2.4.0,<2.4.21d04d7d93f4ed3854abf75d6b712d72c3f70d6b6
python PyPItensorflow-gpu<1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6||>=2.4.0,<2.4.21d04d7d93f4ed3854abf75d6b712d72c3f70d6b6

References

Verify integrity in audit chain (admin only). AS-IS.