PT-2021-18263 · Google · Tensorflow
Published
2021-05-14
·
Updated
2024-03-06
·
CVE-2021-29512
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
TensorFlow versions prior to 2.5.0
TensorFlow version 2.4.2
TensorFlow version 2.3.3
Description:
The issue arises when the
splits argument of RaggedBincount does not specify a valid SparseTensor. This can trigger a heap buffer overflow, causing a read from outside the bounds of the splits tensor buffer in the implementation of the RaggedBincount op. The user controls the splits array, and by making it contain only one element, 0, the code in the while loop would increment batch idx and then try to read splits(1), which is outside of bounds.Recommendations:
For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue.
For TensorFlow version 2.4.2, apply the cherrypicked commit to resolve the issue.
For TensorFlow version 2.3.3, apply the cherrypicked commit to resolve the issue.
As a temporary workaround, consider restricting the use of the
RaggedBincount op with untrusted input until a patch is available.Exploit
Fix
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tensorflow