CVE-2021-41228

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*

History

10 Nov 2021, 13:13

Type Values Removed Values Added
References (CONFIRM) https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582v - (CONFIRM) https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582v - Exploit, Third Party Advisory
References (MISC) https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7 - (MISC) https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : 7.5
v2 : 4.6
v3 : 7.8
CPE cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
CWE CWE-78 CWE-94

05 Nov 2021, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-11-05 23:15

Updated : 2023-12-10 14:09


NVD link : CVE-2021-41228

Mitre link : CVE-2021-41228

CVE.ORG link : CVE-2021-41228


JSON object : View

Products Affected

google

  • tensorflow
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')