PT-2021-21762 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37647

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4

Description The issue arises when a user does not supply arguments that determine a valid sparse tensor, causing the tf.raw ops.SparseTensorSliceDataset implementation to dereference a null pointer. This occurs when either indices or values are provided for an empty sparse tensor when the other is not. Specifically, if indices is empty, the code that performs validation results in a null pointer dereference. The indices in the C++ code is backed by an empty std::vector, and calling indices->dim size(0) results in null pointer dereferencing.

Recommendations For TensorFlow versions prior to 2.6.0, update to TensorFlow 2.6.0 or later to resolve the issue. For TensorFlow version 2.5.1, apply the patch from GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7 or update to a later version. For TensorFlow version 2.4.3, apply the patch from GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7 or update to a later version. For TensorFlow version 2.3.4, apply the patch from GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7 or update to a later version. As a temporary workaround, consider validating user-supplied indices and values to ensure they determine a valid sparse tensor before passing them to tf.raw ops.SparseTensorSliceDataset.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-37647

CVE-2021-37647

GHSA-C5X2-P679-95WC

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-269

PYSEC-2021-560

PYSEC-2021-758

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/02cc160e29d20631de3859c6653184e3f876b9d7 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-560 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37647 · Security Note
• https://osv.dev/vulnerability/GHSA-c5x2-p679-95wc · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-758 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37647 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-269 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c5x2-p679-95wc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-269.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-758.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-560.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note