VULNERABILITY INTELLIGENCE

CVE-2021-29611

CVSS score3.6 LOW

EPSS probability0.20%

CISA KEVNot currently listed

Published2021-05-14

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6ea5f48415854223285/tensorflow/core/kernels/sparse_reshape_op.cc#L40) has no validation that the input arguments specify a valid sparse tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

Weakness classification

security-advisories@github.com: CWE-665
nvd@nist.gov: CWE-20

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory