PT-2021-18325 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29574

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description The implementation of tf.raw ops.MaxPool3DGradGrad exhibits undefined behavior by dereferencing null pointers backing attacker-supplied empty tensors. The implementation fails to validate that the 3 tensor inputs are not empty. If any of them is empty, then accessing the elements in the tensor results in dereferencing a null pointer.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later. As a temporary workaround, consider validating the input tensors to ensure they are not empty before calling tf.raw ops.MaxPool3DGradGrad.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29574

CVE-2021-29574

GHSA-828X-QC2P-WPRQ

PYSEC-2021-211

PYSEC-2021-502

PYSEC-2021-700

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-828x-qc2p-wprq · Exploit
• https://github.com/tensorflow/tensorflow/commit/a3d9f9be9ac2296615644061b40cefcee341dcc4 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-211 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29574 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-700 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-828x-qc2p-wprq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29574 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29574 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-211.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-502.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-700.yaml · Note