PT-2021-18319 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29568

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description An attacker can trigger undefined behavior by binding to a null pointer in tf.raw ops.ParameterizedTruncatedNormal. This occurs because the implementation does not validate input arguments before accessing the first element of shape. If the shape argument is empty, then shape tensor.flat<T>() is an empty array.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, update to version 2.4.2 or later with the cherry-picked commit. For TensorFlow version 2.3.3, update to version 2.3.3 or later with the cherry-picked commit. For TensorFlow version 2.2.3, update to version 2.2.3 or later with the cherry-picked commit. For TensorFlow version 2.1.4, update to version 2.1.4 or later with the cherry-picked commit. As a temporary workaround, consider validating the shape argument before passing it to tf.raw ops.ParameterizedTruncatedNormal to prevent undefined behavior.

Exploit

Fix

Access of Uninitialized Pointer

NULL Pointer Dereference

Weakness Enumeration

CWE-824

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29568

CVE-2021-29568

GHSA-4P4P-WWW8-8FV9

PYSEC-2021-205

PYSEC-2021-496

PYSEC-2021-694

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4p4p-www8-8fv9 · Exploit
• https://github.com/tensorflow/tensorflow/commit/5e52ef5a461570cfb68f3bdbbebfe972cb4e0fd8 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29568 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-496 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4p4p-www8-8fv9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-205 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-694 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-205.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-496.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-694.yaml · Note