CVE-2021-29544: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability (CVE-2021-29544) that could trigger a denial of service via a CHECK-fail in tf.raw_ops.QuantizeAndDequantizeV4Grad. The vulnerability was discovered by Yakun Zhang and Ying Wang of Baidu X-Team and was disclosed on May 13, 2021. The affected versions include TensorFlow 2.4.0 and 2.4.1 (GitHub Advisory).

The vulnerability occurs because the implementation does not validate the rank of the input_* tensors. When these tensors are passed to QuantizeAndDequantizePerChannelGradientImpl, the vec method requires the rank to be 1 and triggers a CHECK failure if this requirement is not met. The issue can be triggered by providing input tensors with incorrect ranks to the tf.raw_ops.QuantizeAndDequantizeV4Grad operation (GitHub Advisory).

An attacker can exploit this vulnerability to cause a denial of service condition in applications using the affected TensorFlow versions. The impact is considered Low severity according to the official advisory (GitHub Advisory).

The vulnerability can be triggered by providing specifically crafted input tensors to the tf.raw_ops.QuantizeAndDequantizeV4Grad function. A proof of concept exploit involves using input tensors with incorrect ranks, such as creating tensors with shape [1,1] instead of the required rank 1 (GitHub Advisory).

The vulnerability has been patched in TensorFlow 2.5.0 and backported to TensorFlow 2.4.2. Users should upgrade to these patched versions. The fix involves adding proper validation of input tensor ranks before processing (GitHub Commit).