PT-2021-18357 · Google · Tensorflow

Mihaimaruseac · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29606

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description A specially crafted TFLite model could trigger an out-of-bounds read on the heap in the TFLite implementation of Split V. If the axis value is not a value between 0 and NumDimensions(input), then the SizeOfDimension function will access data outside the bounds of the tensor shape array.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, cherrypick the commit to the respective version. For versions 2.3.3 and earlier, cherrypick the commit to the respective version. For versions 2.2.3 and earlier, cherrypick the commit to the respective version. For versions 2.1.4 and earlier, cherrypick the commit to the respective version. As a temporary workaround, consider restricting the use of the Split V function until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2021-29606

CVE-2021-29606

GHSA-H4PC-GX2W-F2XV

PYSEC-2021-243

PYSEC-2021-534

PYSEC-2021-732

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h4pc-gx2w-f2xv · Exploit
• https://github.com/tensorflow/tensorflow/commit/ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-732 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-243 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29606 · Security Note
• https://osv.dev/vulnerability/GHSA-h4pc-gx2w-f2xv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29606 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29606 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d563967da813fa50fe20b21f4da683/tensorflow/lite/kernels/split_v.cc#L99 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-732.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-243.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-534.yaml · Note