PT-2021-18334 · Google · Tensorflow
Yakun Zhang
+1
·
Published
2021-05-14
·
Updated
2024-03-06
·
CVE-2021-29583
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TensorFlow versions prior to 2.5.0
TensorFlow versions 2.4.2 and earlier
TensorFlow versions 2.3.3 and earlier
TensorFlow versions 2.2.3 and earlier
TensorFlow versions 2.1.4 and earlier
Description
The implementation of
tf.raw ops.FusedBatchNorm is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation fails to validate that scale, offset, mean, and variance all have the same number of elements as the number of channels of x. This results in heap out of bounds reads when the buffers backing these tensors are indexed past their boundary.Recommendations
For TensorFlow versions prior to 2.5.0, update to TensorFlow 2.5.0 or later.
For TensorFlow versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later.
For TensorFlow versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later.
For TensorFlow versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later.
For TensorFlow versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later.
As a temporary workaround, consider validating the number of elements in
scale, offset, mean, and variance to ensure they match the number of channels of x before calling tf.raw ops.FusedBatchNorm.Exploit
Fix
Out of bounds Read
NULL Pointer Dereference
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tensorflow