PT-2021-18356 · Google · Tensorflow

Mihaimaruseac · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29605

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issue. An attacker can craft a model such that the size multiplier is so large that the return value overflows the int datatype and becomes negative. This results in an invalid value being given to malloc. In this case, ret->size would dereference an invalid pointer.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the patch from GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5. For TensorFlow version 2.3.3, apply the patch from GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5. For TensorFlow version 2.2.3, apply the patch from GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5. For TensorFlow version 2.1.4, apply the patch from GitHub commit 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5. As a temporary workaround, consider restricting the use of the TfLiteIntArrayCreate function until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2021-29605

CVE-2021-29605

GHSA-JF7H-7M85-W2V2

PYSEC-2021-242

PYSEC-2021-533

PYSEC-2021-731

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jf7h-7m85-w2v2 · Exploit
• https://github.com/tensorflow/tensorflow/commit/7c8cc4ec69cd348e44ad6a2699057ca88faad3e5 · Patch
• https://osv.dev/vulnerability/GHSA-jf7h-7m85-w2v2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29605 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-731 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29605 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29605 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-242 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L24-L27 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-533.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-731.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-242.yaml · Note