PT-2021-21770 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37654

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow using tf.raw ops.ResourceGather or a read from outside the bounds of heap allocated data in the same API in a release build. The implementation does not check that the batch dims value that the user supplies is less than the rank of the input tensor, resulting in reading data from outside the bounds of heap allocated buffer backing the tensor.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider restricting the use of tf.raw ops.ResourceGather until a patch is available. Avoid using the batch dims parameter with values that are not less than the rank of the input tensor in the affected API endpoint until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2021-37654

CVE-2021-37654

GHSA-2R8P-FG3C-WCJ4

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-276

PYSEC-2021-567

PYSEC-2021-765

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/bc9c546ce7015c57c2f15c168b3d9201de679a1d · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-567 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r8p-fg3c-wcj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37654 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-765 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37654 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-276 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37654 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r8p-fg3c-wcj4 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-765.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-276.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-567.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note