PT-2021-18292 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29541

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description An attacker can trigger a dereference of a null pointer in tf.raw ops.StringNGrams because the implementation does not fully validate the data splits argument. This results in ngrams data being a null pointer when the output would be computed to have 0 or negative size, causing a null pointer dereference when writing to the output tensor.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the patch from GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b. For TensorFlow version 2.3.3, apply the patch from GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b. For TensorFlow version 2.2.3, apply the patch from GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b. For TensorFlow version 2.1.4, apply the patch from GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b. As a temporary workaround, consider disabling the tf.raw ops.StringNGrams function until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29541

CVE-2021-29541

GHSA-XQFJ-35WV-M3CR

PYSEC-2021-178

PYSEC-2021-469

PYSEC-2021-667

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xqfj-35wv-m3cr · Exploit
• https://github.com/tensorflow/tensorflow/commit/ba424dd8f16f7110eea526a8086f1a155f14f22b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29541 · Security Note
• https://osv.dev/vulnerability/GHSA-xqfj-35wv-m3cr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-667 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29541 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29541 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-469 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-178 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-469.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-178.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-667.yaml · Note