PT-2021-18328 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29577

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description The implementation of tf.raw ops.AvgPool3DGrad is vulnerable to a heap buffer overflow. The issue arises from the assumption that the orig input shape and grad tensors have similar first and last dimensions without validating this assumption.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow versions 2.4.2 and earlier, update to version 2.4.2 or later. For TensorFlow versions 2.3.3 and earlier, update to version 2.3.3 or later. For TensorFlow versions 2.2.3 and earlier, update to version 2.2.3 or later. For TensorFlow versions 2.1.4 and earlier, update to version 2.1.4 or later.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BIT-TENSORFLOW-2021-29577

CVE-2021-29577

GHSA-V6R6-84GR-92RM

PYSEC-2021-214

PYSEC-2021-505

PYSEC-2021-703

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-v6r6-84gr-92rm · Exploit
• https://github.com/tensorflow/tensorflow/commit/6fc9141f42f6a72180ecd24021c3e6b36165fe0d · Patch
• https://osv.dev/vulnerability/GHSA-v6r6-84gr-92rm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29577 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29577 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-703 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-214 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29577 · Security Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-703.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-505.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-214.yaml · Note