PT-2021-18343 · Google · Tensorflow

Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29592

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description The issue arises when the target shape of the Reshape operator is given by the elements of a 1-D tensor, allowing a null-buffer-backed tensor with a 1D shape to be passed. This occurs because the fix for the vulnerability missed this specific case. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, cherrypick the commit on TensorFlow 2.4.2. For versions 2.3.3 and earlier, cherrypick the commit on TensorFlow 2.3.3. For versions 2.2.3 and earlier, cherrypick the commit on TensorFlow 2.2.3. For versions 2.1.4 and earlier, cherrypick the commit on TensorFlow 2.1.4. As a temporary workaround, consider restricting the use of the Reshape operator with 1-D tensor shapes until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29592

CVE-2021-29592

GHSA-JJR8-M8G8-P6WV

PYSEC-2021-229

PYSEC-2021-520

PYSEC-2021-718

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jjr8-m8g8-p6wv · Exploit
• https://github.com/tensorflow/tensorflow/commit/f8378920345f4f4604202d4ab15ef64b2aceaa16 · Patch
• https://osv.dev/vulnerability/GHSA-jjr8-m8g8-p6wv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29592 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-520 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29592 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-718 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29592 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-229 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/9c1dc920d8ffb4893d6c9d27d1f039607b326743/tensorflow/lite/core/subgraph.cc#L1062-L1074 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-229.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-718.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-520.yaml · Note