PT-2021-21758 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37643

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description The issue occurs when a user does not provide a valid padding value to tf.raw ops.MatrixDiagPartOp, triggering a null pointer dereference if the input is empty or producing invalid behavior by ignoring all values after the first. The implementation reads the first value from a tensor buffer without checking if the tensor has values to read from.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider validating the input to tf.raw ops.MatrixDiagPartOp to ensure a valid padding value is provided.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-37643

CVE-2021-37643

GHSA-FCWC-P4FC-C5CC

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-265

PYSEC-2021-556

PYSEC-2021-754

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/482da92095c4d48f8784b1f00dda4f81c28d2988 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fcwc-p4fc-c5cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37643 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-265 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37643 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-754 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fcwc-p4fc-c5cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-754.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-556.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-265.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note