PT-2021-18335 · Google · Tensorflow

Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29584

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description An attacker can trigger a denial of service via a CHECK-fail caused by an integer overflow in constructing a new tensor shape. This occurs because the implementation builds a dense shape without checking that the dimensions would not result in overflow. The TensorShape constructor uses a CHECK operation which triggers when InitDims returns a non-OK status. This is a legacy implementation of the constructor and operations should use BuildTensorShapeBase or AddDimWithStatus to prevent CHECK-failures in the presence of overflows.

Recommendations Update to TensorFlow 2.5.0 or later to resolve the issue. For versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, apply the cherrypicked commit to fix the issue. As a temporary workaround, consider using BuildTensorShapeBase or AddDimWithStatus to prevent CHECK-failures in the presence of overflows. Restrict access to the TensorShape constructor to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2021-29584

CVE-2021-29584

GHSA-XVJM-FVXX-Q3HV

PYSEC-2021-221

PYSEC-2021-512

PYSEC-2021-710

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvjm-fvxx-q3hv · Exploit
• https://github.com/tensorflow/tensorflow/commit/4c0ee937c0f61c4fc5f5d32d9bb4c67428012a60 · Patch
• https://osv.dev/vulnerability/CVE-2021-29584 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-710 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xvjm-fvxx-q3hv · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-512 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-221 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29584 · Security Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-221.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-710.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-512.yaml · Note
• https://t.me/cvenotify/23063 · Telegram Post
• https://t.me/cvenotify/23065 · Telegram Post