PT-2021-21772 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37656

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description TensorFlow is an end-to-end open source platform for machine learning. In affected versions, an attacker can cause undefined behavior via binding a reference to null pointer in tf.raw ops.RaggedTensorToSparse. The implementation has an incomplete validation of the splits values: it does not check that they are in increasing order.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider disabling the tf.raw ops.RaggedTensorToSparse function until a patch is available.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-37656

CVE-2021-37656

GHSA-4XFP-4PFP-89WG

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-278

PYSEC-2021-569

PYSEC-2021-767

Affected Products

Tensorflow

References · 88

• https://github.com/tensorflow/tensorflow/commit/1071f554dbd09f7e101324d366eec5f4fe5a3ece · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37656 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37656 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37656 · Security Note
• https://osv.dev/vulnerability/GHSA-4xfp-4pfp-89wg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-569 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-767 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4xfp-4pfp-89wg · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-569.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-278.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-767.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note