PT-2021-18285 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29534

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description: An attacker can trigger a denial of service via a CHECK-fail in tf.raw ops.SparseConcat. This occurs because the implementation takes the values specified in shapes[0] as dimensions for the output shape. The TensorShape constructor uses a CHECK operation which triggers when InitDims returns a non-OK status, typically due to overflow when adding a dimension from the argument. This is a legacy implementation of the constructor, and operations should use BuildTensorShapeBase or AddDimWithStatus to prevent CHECK-failures in the presence of overflows.

Recommendations: For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later. As a temporary workaround, consider avoiding the use of tf.raw ops.SparseConcat with large input shapes until a patch is available.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-TENSORFLOW-2021-29534

CVE-2021-29534

GHSA-6J9C-GRC6-5M6G

PYSEC-2021-171

PYSEC-2021-462

PYSEC-2021-660

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6j9c-grc6-5m6g · Exploit
• https://github.com/tensorflow/tensorflow/commit/69c68ecbb24dff3fa0e46da0d16c821a2dd22d7c · Patch
• https://osv.dev/vulnerability/GHSA-6j9c-grc6-5m6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29534 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-462 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29534 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-660 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29534 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-171 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-660.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-462.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-171.yaml · Note