PT-2021-18367 · Google · Tensorflow

Mihaimaruseac · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29616

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description The implementation of TrySimplify has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the patch from GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3 or update to a later version. For TensorFlow version 2.3.3, apply the patch from GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3 or update to a later version. For TensorFlow version 2.2.3, apply the patch from GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3 or update to a later version. For TensorFlow version 2.1.4, apply the patch from GitHub commit e6340f0665d53716ef3197ada88936c2a5f7a2d3 or update to a later version.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-29616

CVE-2021-29616

GHSA-4HVV-7X94-7VQ8

PYSEC-2021-253

PYSEC-2021-544

PYSEC-2021-742

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvv-7x94-7vq8 · Exploit
• https://github.com/tensorflow/tensorflow/commit/e6340f0665d53716ef3197ada88936c2a5f7a2d3 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-544 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29616 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29616 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-253 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hvv-7x94-7vq8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29616 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-544.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-253.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-742.yaml · Note