PT-2021-18291 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29540

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description An attacker can cause a heap buffer overflow to occur in Conv2DBackpropFilter. This is because the implementation computes the size of the filter tensor but does not validate that it matches the number of elements in filter sizes. Later, when reading/writing to this buffer, code uses the value computed here, instead of the number of elements in the tensor.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

BIT-TENSORFLOW-2021-29540

CVE-2021-29540

GHSA-XGC3-M89P-VR3X

PYSEC-2021-177

PYSEC-2021-468

PYSEC-2021-666

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xgc3-m89p-vr3x · Exploit
• https://github.com/tensorflow/tensorflow/commit/c570e2ecfc822941335ad48f6e10df4e21f11c96 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29540 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-666 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29540 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-177 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-468 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgc3-m89p-vr3x · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-177.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-468.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-666.yaml · Note