CVE-2021-41203

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-41203
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-41203.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-41203
Aliases
Downstream
Related
Published
2021-11-05T21:15:08Z
Modified
2025-10-15T14:16:46.298479Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
368af875869a204b4ac552b9ddda59f6a46a56ec
Fixed
abcced051cb1bd8fb05046ac3b6023a7ebcc4578
Fixed
b619c6f865715ca3b15ef1842b5b95edbaa710ad
Fixed
e8dc63704c88007ee4713076605c90188d66f3d2

Affected versions

0.*

0.12.0-rc0
0.12.0-rc1
0.12.1
0.5.0
0.6.0

v0.*

v0.10.0
v0.10.0rc0
v0.11.0
v0.11.0rc0
v0.11.0rc1
v0.11.0rc2
v0.12.0
v0.7.0
v0.7.1
v0.8.0rc0
v0.9.0
v0.9.0rc0

v1.*

v1.0.0
v1.0.0-alpha
v1.0.0-rc0
v1.0.0-rc1
v1.0.0-rc2
v1.1.0
v1.1.0-rc0
v1.1.0-rc1
v1.1.0-rc2
v1.12.0
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.12.1
v1.2.0
v1.2.0-rc0
v1.2.0-rc1
v1.2.0-rc2
v1.3.0-rc0
v1.3.0-rc1
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.8.0
v1.8.0-rc0
v1.8.0-rc1
v1.9.0
v1.9.0-rc0
v1.9.0-rc1
v1.9.0-rc2

Database specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "163647374727669981188558835584190376145",
                    "119230524923169879445465171829055581225",
                    "317046875226210503871369938846111627529",
                    "278843921136097413994511215386214773417"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad",
            "id": "CVE-2021-41203-07c671e0"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader.h"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "312305273853118166188585187611609534496",
                    "90156162504254549027624569239833629515",
                    "81240825261637672659041977819244322820",
                    "322033883981594524855286535988765043051"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec",
            "id": "CVE-2021-41203-092576d1"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/framework/tensor_slice_test.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "77901668405868823783643355558711886832",
                    "332618260606954479836386694963328651965",
                    "98215630143819954934758172937014425092",
                    "4392583158894389565167875248718526929"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2",
            "id": "CVE-2021-41203-131bf026"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/framework/tensor.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "92885866821705672988723167574708687408",
                    "27619923433612519950949942879868694664",
                    "90656619939142732141149287094529443089",
                    "140268898389280157903177883856583643548",
                    "265255458309759242349769091073910469446",
                    "339363361888113022949243499935933339359",
                    "67293106854734138044663584143872122787",
                    "246540610708628357462553576606810387938",
                    "63677565616346991662152379882322909358",
                    "88500101236622833773678633216030531428",
                    "306805931543828475888640272249835211175",
                    "86597593560673576499320662882157698964",
                    "254012707912356266197549951326219056119",
                    "136755794849542534105946462224206786127",
                    "142250487287170433910951871924818646966",
                    "24743933728032400516388773908325198615",
                    "111394315821197690375022199311867589503",
                    "182429558531998351268575771155135943651",
                    "30282336968312784424976514346503062843",
                    "27327900539716252618259910910462311400"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578",
            "id": "CVE-2021-41203-3550bbfd"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/framework/tensor_slice.h"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "302407712021049901449639567642298750442",
                    "52132853492877886718469951208273653688",
                    "89903773390670921604241354224132523887"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2",
            "id": "CVE-2021-41203-5d9b3d8b"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "49946661870912069471452825615438700614",
                    "221122942561633972140512496542180620713",
                    "10852187441811387836830027488474167575",
                    "164472592718178906313746018705318449112"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578",
            "id": "CVE-2021-41203-7bb28f14"
        },
        {
            "signature_type": "Function",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader.cc",
                "function": "TensorSliceReader::LoadShard"
            },
            "signature_version": "v1",
            "digest": {
                "length": 1224.0,
                "function_hash": "168908859537380674487760372630143862065"
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad",
            "id": "CVE-2021-41203-7f054242"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/framework/tensor_slice.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "283027630126721545252284719375387094042",
                    "7958148781045711084323829773363477285",
                    "157702530996186976503979731994489835480",
                    "107180054752083492416764459890932147678",
                    "267531693270620500045636518577244991508"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2",
            "id": "CVE-2021-41203-93d496fe"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader_test.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "151254164971738304426987066080833139623",
                    "279030632372620941509417783999070664808",
                    "295761620786407612632795150305789286388",
                    "177958394458803373441411897313116739468",
                    "200407677642278063365675112861953294192",
                    "203965484176799906260998983576796172510"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad",
            "id": "CVE-2021-41203-969c3184"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/framework/tensor.h"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "169735514574254393125197142892160976458",
                    "226033796201603409981066363320136948337",
                    "134125187851771575348042168887346401724"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578",
            "id": "CVE-2021-41203-e0ce85dc"
        },
        {
            "signature_type": "Function",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader.h",
                "function": "TensorSliceReader::CopySliceData"
            },
            "signature_version": "v1",
            "digest": {
                "length": 1407.0,
                "function_hash": "70294013188193661943933084081200920528"
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec",
            "id": "CVE-2021-41203-e203a30c"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/tensor_slice_reader_test.cc"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "172073213481956060732962534164343877054",
                    "329654921900483318113448358375918428612",
                    "244831194617314343341134726121099067088",
                    "312255763357754498869072798621145870359",
                    "178350732595796200668613424684811257699",
                    "152515301966047613211064306310348989395",
                    "67322904609538483355780021337704005028",
                    "268940505784188759720631992015402853180",
                    "228166703723755052443194282084815226345",
                    "149335801124874619030155626069179377002",
                    "334180908566994349868881524603349683886",
                    "206146818982078044289933851640057348617",
                    "14869403388373139471608194624789344177",
                    "111214416824334282273553005099435654714"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578",
            "id": "CVE-2021-41203-f97cab30"
        },
        {
            "signature_type": "Line",
            "target": {
                "file": "tensorflow/core/util/saved_tensor_slice_util.h"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "183300508423947642284748196258684449990",
                    "116226507171714253989011762667952961577",
                    "115249336385253944835188153675830086395",
                    "165329619292956997976632283416630217497",
                    "174912558512634366300063689927585753860",
                    "65866733277093865538233211268353396365",
                    "254305968883076659399698477808611574120",
                    "207435076094153713430695336784023952028",
                    "154573877585303822232512686052883244731",
                    "62540305155010591443784422140508243992",
                    "263889545825736534849679297957251909284",
                    "314528642261553591629384885579261980634",
                    "107643886962641796168206265595835541286",
                    "331114867861899033440566045001577802466",
                    "76500621179752983928140923871041139727",
                    "287885323780284678337051131499411739737",
                    "195843189973530808154429005194082978581",
                    "335032318025637987995071095940699459896",
                    "39388676496491573877879971711632713159",
                    "233294197971360293815832544303279409316"
                ]
            },
            "deprecated": false,
            "source": "https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec",
            "id": "CVE-2021-41203-fa0c6bb0"
        }
    ]
}