PT-2021-18322 · Google · Tensorflow
Yakun Zhang
+1
·
Published
2021-05-14
·
Updated
2024-03-06
·
CVE-2021-29571
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TensorFlow versions prior to 2.5.0
TensorFlow versions 2.4.2 and earlier
TensorFlow versions 2.3.3 and earlier
TensorFlow versions 2.2.3 and earlier
TensorFlow versions 2.1.4 and earlier
Description
The implementation of
tf.raw ops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if an attacker supplies specially crafted inputs. The issue arises because the implementation assumes that the last element of boxes input is 4, as required by the op, but this is not checked. Attackers passing values less than 4 can write outside of bounds of heap allocated objects and cause memory corruption. If the last dimension in boxes is less than 4, accesses similar to tboxes(b, bb, 3) will access data outside of bounds. Further, during code execution, there are also writes to these indices.Recommendations
For TensorFlow versions prior to 2.5.0, update to TensorFlow 2.5.0 or later.
For TensorFlow versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later.
For TensorFlow versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later.
For TensorFlow versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later.
For TensorFlow versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later.
As a temporary workaround, consider restricting the use of the
tf.raw ops.DrawBoundingBoxesV2 function until a patch is available.
Avoid using the boxes input with a last dimension less than 4 in the affected API endpoint until the issue is resolved.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tensorflow