LiveActive security incident?Get immediate response
CVE Record

CVE-2021-29533: CHECK-fail in DrawBoundingBoxes

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK` failure by passing an empty image to `tf.raw_ops.DrawBoundingBoxes`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/ea34a18dc3f5c8d80a40ccca1404f343b5d55f91/tensorflow/core/kernels/image/draw_bounding_box_op.cc#L148-L165) uses `CHECK_*` assertions instead of `OP_REQUIRES` to validate user controlled inputs. Whereas `OP_REQUIRES` allows returning an error condition back to the user, the `CHECK_*` macros result in a crash if the condition is false, similar to `assert`. In this case, `height` is 0 from the `images` input. This results in `max_box_row_clamp` being negative and the assertion being falsified, followed by aborting program execution. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

LowCVSS 2.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2021-29533 is a low-severity TensorFlow denial-of-service issue. A local user with low privileges can crash a TensorFlow process if they can pass an empty image into a specific bounding-box drawing operation. The sources do not indicate data theft, model tampering, or active exploitation.

Executive priority

Treat this as a routine availability fix unless affected TensorFlow workloads are multi-tenant or process untrusted ML inputs. Prioritize normal dependency patching and targeted exposure review over emergency response.

Technical view

TensorFlow DrawBoundingBoxes used CHECK assertions instead of OP_REQUIRES for user-controlled input validation. With an empty image, height becomes 0, a clamp value becomes negative, and the failed assertion aborts execution. Affected versions include TensorFlow before fixed 2.1.4, 2.2.3, 2.3.3, and 2.4.2 releases.

Likely exposure

Exposure is most likely in ML notebooks, pipelines, batch jobs, or services running affected TensorFlow versions where untrusted or tenant-controlled inputs can reach tf.raw_ops.DrawBoundingBoxes. The CVSS vector indicates local access, high attack complexity, low privileges, and availability-only impact.

Exploitation context

The cited sources describe a crash condition, not remote code execution. The bundle states KEV is false, and no cited source supports active exploitation. Business risk is limited to process interruption where an attacker can influence TensorFlow operation inputs.

Researcher notes

The root issue is improper error handling for user-controlled input, classified as CWE-754. The vendor states CHECK_* caused process aborts where OP_REQUIRES should return an error. Evidence is sufficient for affected versions and fix direction, but not for exploitation in the wild.

Mitigation direction

  • Upgrade to TensorFlow 2.5.0 or fixed supported patch releases 2.4.2, 2.3.3, 2.2.3, or 2.1.4.
  • If upgrading is delayed, restrict untrusted input paths reaching tf.raw_ops.DrawBoundingBoxes.
  • Check TensorFlow vendor guidance for exact supported remediation and backport status.
  • Monitor ML workloads for unexpected process aborts involving image bounding-box operations.

Validation and detection

  • Inventory TensorFlow versions in applications, notebooks, containers, and model-serving images.
  • Identify code paths that call tf.raw_ops.DrawBoundingBoxes or wrappers using it.
  • Confirm deployed versions are outside the affected ranges listed by the advisory.
  • Review logs for crashes referencing DrawBoundingBoxes, CHECK failures, or image kernel aborts.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-754: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-29533 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.5CVSS 3.1LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L11.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.5Low
CVSS 3.1 vector shape for CVE-2021-29533Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tensorflowtensorflow< 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2Listed
Weakness

CWE details

CWE-754

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-754 · source CWE mapping

Improper Check for Unusual or Exceptional Conditions

Improper Check for Unusual or Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs