PT-2021-18317 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29566

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.raw ops.Dilation2DBackpropInput. This is because the implementation does not validate before writing to the output array. The values for h out and w out are guaranteed to be in range for out backprop, but there are no similar guarantees relating h in max/w in max and in backprop.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later. As a temporary workaround, consider restricting the use of tf.raw ops.Dilation2DBackpropInput until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-TENSORFLOW-2021-29566

CVE-2021-29566

GHSA-PVRC-HG3F-58R6

PYSEC-2021-203

PYSEC-2021-494

PYSEC-2021-692

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pvrc-hg3f-58r6 · Exploit
• https://github.com/tensorflow/tensorflow/commit/3f6fe4dfef6f57e768260b48166c27d148f3015f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29566 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29566 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-692 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pvrc-hg3f-58r6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29566 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-494 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-692.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-494.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-203.yaml · Note
• https://t.me/cvenotify/14548 · Telegram Post