CVE-2021-29616

critical
Published 2021-05-21 · Modified 2023-12-06
CVSS v3
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v2
VIR risk
9.5

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplify(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Predictions

Exploit likelihood
20%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-29616

OS impact

OSVersionStatusFixed in
arch archfixed2.5.0-1
debian debianforkyfixed0
debian debiansidfixed0

Package impact

EcosystemPackageVulnerableFixed
python PyPItensorflow>=2.2.0,<2.2.32.2.3
python PyPItensorflow>=2.3.0,<2.3.32.3.3
python PyPItensorflow<2.1.42.1.4
python PyPItensorflow-gpu>=2.2.0,<2.2.32.2.3
python PyPItensorflow-gpu>=2.3.0,<2.3.32.3.3
python PyPItensorflow-gpu>=2.4.0,<2.4.22.4.2
python PyPItensorflow>=2.4.0,<2.4.22.4.2
python PyPItensorflow-cpu<2.1.42.1.4
python PyPItensorflow-cpu>=2.2.0,<2.2.32.2.3
python PyPItensorflow-cpu>=2.3.0,<2.3.32.3.3
python PyPItensorflow-cpu>=2.4.0,<2.4.22.4.2
python PyPItensorflow-gpu<2.1.42.1.4
python PyPItensorflow<e6340f0665d53716ef3197ada88936c2a5f7a2d3||>=2.4.0,<2.4.3e6340f0665d53716ef3197ada88936c2a5f7a2d3
python PyPItensorflow-cpu<e6340f0665d53716ef3197ada88936c2a5f7a2d3||>=2.4.0,<2.4.3e6340f0665d53716ef3197ada88936c2a5f7a2d3
python PyPItensorflow-gpu<e6340f0665d53716ef3197ada88936c2a5f7a2d3||>=2.4.0,<2.4.3e6340f0665d53716ef3197ada88936c2a5f7a2d3

References

Verify integrity in audit chain (admin only). AS-IS.