PT-2021-21767 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37651

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4

Description The implementation for tf.raw ops.FractionalAvgPoolGrad can be tricked into accessing data outside of bounds of heap allocated buffers. The issue arises because the implementation does not validate that the input tensor is non-empty, resulting in the construction of an empty EigenDoubleMatrixMap and subsequent access to this buffer with indices that are outside of the empty area.

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow version 2.5.1, apply the patch from GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30. For TensorFlow version 2.4.3, apply the patch from GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30. For TensorFlow version 2.3.4, apply the patch from GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30. As a temporary workaround, consider restricting the use of the tf.raw ops.FractionalAvgPoolGrad function until a patch is available.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BIT-TENSORFLOW-2021-37651

CVE-2021-37651

GHSA-HPV4-7P9C-MVFR

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-273

PYSEC-2021-564

PYSEC-2021-762

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/0f931751fb20f565c4e94aa6df58d54a003cdb30 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpv4-7p9c-mvfr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37651 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37651 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-762 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37651 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-273 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-564 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hpv4-7p9c-mvfr · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-273.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-762.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-564.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note