CVE-2021-35958

Vulnerability

The vulnerability resides in tf.keras.utils.get_file when called with extract=True. The function uses Python's tarfile.extractall() without validating archive contents, allowing path traversal via symlinks or entries with absolute paths [1][2]. Affected versions include TensorFlow through 2.5.0 [4]. The vendor disputes this as a security issue, stating the function is not intended for untrusted archives [4].

Exploitation

An attacker must craft a malicious tar archive containing entries that overwrite files outside the extraction directory (e.g., using ../ paths or symbolic links). The victim must call tf.keras.utils.get_file with extract=True on this archive, typically by downloading it from an untrusted source. No additional authentication or privileges are required beyond the ability to supply the archive [2][4].

Impact

Successful exploitation allows arbitrary file write or overwrite on the host filesystem. This can lead to code execution (e.g., overwriting Python scripts or configuration files), privilege escalation, or denial of service. The attacker controls the content and location of the written files [4].

Mitigation

No official patch has been released by the TensorFlow team; the vendor considers the behavior by design [4]. Users should avoid using extract=True with untrusted archives. As a workaround, manually validate or extract archives using a safer method. Python 3.12+ introduced extraction filters that mitigate such attacks, but TensorFlow does not enforce them [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.