PT-2021-18290 · Unknown · Tensorflow

Mihaimaruseac · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29539

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0

Description The issue arises when calling tf.raw ops.ImmutableConst with a dtype of tf.resource or tf.variant, resulting in a segfault. This occurs because the code assumes that the tensor contents are pure scalars.

Recommendations For versions prior to 2.5.0, consider inserting a filter for the dtype argument when using tf.raw ops.ImmutableConst to prevent the segfault. Update to TensorFlow 2.5.0 or use TensorFlow nightly packages after the commit 4f663d4b8f0bec1b48da6fa091a7d29609980fa4 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-681

Related Identifiers

BIT-TENSORFLOW-2021-29539

CVE-2021-29539

GHSA-G4H2-GQM3-C9WQ

PYSEC-2021-176

PYSEC-2021-467

PYSEC-2021-665

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g4h2-gqm3-c9wq · Exploit
• https://github.com/tensorflow/tensorflow/commit/4f663d4b8f0bec1b48da6fa091a7d29609980fa4 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-467 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29539 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4h2-gqm3-c9wq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29539 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-176 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29539 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-665 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-467.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-665.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-176.yaml · Note