PT-2021-18281 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29530

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description: An attacker can trigger a null pointer dereference by providing an invalid permutation to tf.raw ops.SparseMatrixSparseCholesky. This is because the implementation fails to properly validate the input arguments. The ValidateInputs function is called, but it does not properly handle validation failures, allowing the code to proceed with invalid inputs. The issue can be exploited by providing a specially crafted permutation argument to the tf.raw ops.SparseMatrixSparseCholesky function.

Recommendations: For TensorFlow versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For TensorFlow versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For TensorFlow versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For TensorFlow versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For TensorFlow versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later. As a temporary workaround, consider avoiding the use of the tf.raw ops.SparseMatrixSparseCholesky function with untrusted input until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29530

CVE-2021-29530

GHSA-XCWJ-WFCM-M23C

PYSEC-2021-167

PYSEC-2021-458

PYSEC-2021-656

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xcwj-wfcm-m23c · Exploit
• https://github.com/tensorflow/tensorflow/commit/e6a7c7cc18c3aaad1ae0872cb0a959f5c923d2bd · Patch
• https://osv.dev/vulnerability/PYSEC-2021-167 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29530 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-458 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-656 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29530 · Security Note
• https://osv.dev/vulnerability/GHSA-xcwj-wfcm-m23c · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-167.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-656.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-458.yaml · Note