PT-2021-21778 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37661

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4

Description TensorFlow is an end-to-end open source platform for machine learning. In affected versions, an attacker can cause a denial of service in boosted trees create quantile stream resource by using negative arguments. The implementation does not validate that num streams only contains non-negative numbers, resulting in a crash from the standard library due to implicit conversion from a negative value to a large positive unsigned.

Recommendations Update to TensorFlow 2.6.0 or later to resolve the issue. For TensorFlow 2.5.1, update to a newer version that includes the fix. For TensorFlow 2.4.3, update to a newer version that includes the fix. For TensorFlow 2.3.4, update to a newer version that includes the fix. As a temporary workaround, consider validating the num streams argument to ensure it only contains non-negative numbers before calling boosted trees create quantile stream resource.

Fix

Weakness Enumeration

CWE-681

Related Identifiers

BIT-TENSORFLOW-2021-37661

CVE-2021-37661

GHSA-GF88-J2MG-CC82

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-283

PYSEC-2021-574

PYSEC-2021-772

Affected Products

Tensorflow

References · 88

• https://github.com/tensorflow/tensorflow/commit/8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-574 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37661 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37661 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf88-j2mg-cc82 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37661 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-772 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf88-j2mg-cc82 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-574.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-772.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-283.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note