PT-2021-18307 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29556

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description An attacker can cause a denial of service via a FPE runtime error in tf.raw ops.Reverse. This is because the implementation performs a division based on the first dimension of the tensor argument. The issue can be triggered by controlling the first dimension of the tensor argument, allowing an attacker to cause a denial of service.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the patch from GitHub commit 4071d8e2f6c45c1955a811fee757ca2adbe462c1. For TensorFlow version 2.3.3, apply the patch from GitHub commit 4071d8e2f6c45c1955a811fee757ca2adbe462c1. For TensorFlow version 2.2.3, apply the patch from GitHub commit 4071d8e2f6c45c1955a811fee757ca2adbe462c1. For TensorFlow version 2.1.4, apply the patch from GitHub commit 4071d8e2f6c45c1955a811fee757ca2adbe462c1. As a temporary workaround, consider avoiding the use of tf.raw ops.Reverse until a patch is applied.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-29556

CVE-2021-29556

GHSA-FXQH-CFJM-FP93

PYSEC-2021-193

PYSEC-2021-484

PYSEC-2021-682

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fxqh-cfjm-fp93 · Exploit
• https://github.com/tensorflow/tensorflow/commit/4071d8e2f6c45c1955a811fee757ca2adbe462c1 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29556 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-484 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-682 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29556 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxqh-cfjm-fp93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29556 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-193 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-682.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-193.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-484.yaml · Note