PT-2021-18309 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29558

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description An attacker can cause a heap buffer overflow in tf.raw ops.SparseSplit because the implementation accesses an array element based on a user-controlled offset. This results in overriding values on the heap. The issue has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the patch from GitHub commit 8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31. For TensorFlow version 2.3.3, apply the patch from GitHub commit 8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31. For TensorFlow version 2.2.3, apply the patch from GitHub commit 8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31. For TensorFlow version 2.1.4, apply the patch from GitHub commit 8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31. As a temporary workaround, consider avoiding the use of tf.raw ops.SparseSplit until a patch is applied.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-TENSORFLOW-2021-29558

CVE-2021-29558

GHSA-MQH2-9WRP-VX84

PYSEC-2021-195

PYSEC-2021-486

PYSEC-2021-684

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mqh2-9wrp-vx84 · Exploit
• https://github.com/tensorflow/tensorflow/commit/8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29558 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-195 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mqh2-9wrp-vx84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29558 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-684 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-486 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-486.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-195.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-684.yaml · Note