PT-2021-18341 · Google · Tensorflow

Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29590

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description The implementations of the Minimum and Maximum TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty. This is because the broadcasting implementation indexes in both tensors with the same index but does not validate that the index is within bounds.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later. As a temporary workaround, consider disabling the Minimum and Maximum TFLite operators until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2021-29590

CVE-2021-29590

GHSA-24X6-8C7M-HV3F

PYSEC-2021-227

PYSEC-2021-518

PYSEC-2021-716

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-24x6-8c7m-hv3f · Exploit
• https://github.com/tensorflow/tensorflow/commit/953f28dca13c92839ba389c055587cfe6c723578 · Patch
• https://osv.dev/vulnerability/GHSA-24x6-8c7m-hv3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29590 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-716 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-518 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29590 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-227 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29590 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/maximum_minimum.h#L52-L56 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-716.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-227.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-518.yaml · Note
• https://t.me/cvenotify/14664 · Telegram Post