CVE-2021-29591

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-29591
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29591.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-29591
Aliases
Related
Published
2021-05-14T20:15:15.017Z
Modified
2026-02-06T04:56:39.979567Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be replaced by stack overflow due to too many recursive calls. For example, the While implementation(https://github.com/tensorflow/tensorflow/blob/106d8f4fb89335a2c52d7c895b7a7485465ca8d9/tensorflow/lite/kernels/while.cc) could be tricked into a scneario where both the body and the loop subgraphs are the same. Evaluating one of the subgraphs means calling the Eval function for the other and this quickly exhaust all stack space. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Please consult our security guide(https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Fixed
0931ea3d985bb9c8fdd054a5e29c4129623c849b
Introduced
582c8d236cb079023657287c318ff26adb239002
Fixed
1923123d32ea41d92b70a27a3f6ecf0763b56f6c
Introduced
b36436b087bd8e8701ef51718179037cccdfc26e
Fixed
3929ffacfbef7c431e8397920d040aaf47acff19
Fixed
9c1dc920d8ffb4893d6c9d27d1f039607b326743
Fixed
c6173f5fe66cdbab74f4f869311fe6aae2ba35f4
Introduced
2b96f3662bd776e277f86997659e61046b56c315
Fixed
cfe0c80169ae984bcdc99ff6de7444164aaa8e07

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/core/subgraph.cc"
        },
        "id": "CVE-2021-29591-1bd48c1c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "260158867217123508326103716446679945805",
                "187674689968630334265080658367930016381",
                "24740425962405959618072566737777676615",
                "259383789005924680633867872382627957644",
                "35857747728290383188379822289152003824",
                "304354338318044281315393335385327751999",
                "78364547626486490139560323617177646932",
                "285377074578786963373039744068565308111",
                "329336214861993778481197341510924049052",
                "72233375791881959058120631298465393711",
                "195775786390928312199303563197514002461",
                "190953159252228838560218606621377421434",
                "82643836821904115848785794080301303585",
                "121414632938400417452441879428688227066"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/kernels/while.cc"
        },
        "id": "CVE-2021-29591-21fd5331",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "84609869173860567526266753685106931041",
                "218053022115840864075367158422736590288",
                "179011720538303170748224705773324142137",
                "40822597346098502041300318100635557265",
                "221231780696322042551396790661957494921"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/core/subgraph.cc",
            "function": "Subgraph::AllocateTensors"
        },
        "id": "CVE-2021-29591-2d1889b1",
        "signature_version": "v1",
        "digest": {
            "function_hash": "31620262628260325121768268437426392465",
            "length": 786.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/core/subgraph.cc",
            "function": "Subgraph::Invoke"
        },
        "id": "CVE-2021-29591-45cbbdcc",
        "signature_version": "v1",
        "digest": {
            "function_hash": "50393791142598357229344181897790256193",
            "length": 2350.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/core/subgraph.h"
        },
        "id": "CVE-2021-29591-6c4f8c4d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "177030984041673207379277989237330882570",
                "15093454416643800918670713354690702671",
                "148953215241726230856898327198337864122",
                "235768195372964173850213569719632748295"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4",
        "target": {
            "file": "tensorflow/lite/kernels/while.cc",
            "function": "Prepare"
        },
        "id": "CVE-2021-29591-8bf96fce",
        "signature_version": "v1",
        "digest": {
            "function_hash": "160255049240409248823772866974256770817",
            "length": 2261.0
        },
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29591.json"