CVE-2021-41213

Summary

TensorFlow is an open source platform for machine learning. In affected versions the code behind tf.function API can be made to deadlock when two tf.function decorated Python functions are mutually recursive. This occurs due to using a non-reentrant Lock Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive tf.function, although this is not a frequent scenario. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Affected Software

VendorProductVersion RangeStatus
tensorflowtensorflow>= 2.6.0, < 2.6.1affected
tensorflowtensorflow>= 2.5.0, < 2.5.2affected
tensorflowtensorflow< 2.4.4affected

Weaknesses

  • CWE-667: CWE-667: Improper Locking

ADP Enrichment

CVE Program Container

Additional References

References