PT-2021-21780 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37663

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description Due to incomplete validation in tf.raw ops.QuantizeV2, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays. The implementation has some validation but does not check that min range and max range both have the same non-zero number of elements. If axis is provided, then validation should check that it is a value in range for the rank of input tensor and then the lengths of min range and max range inputs match the axis dimension of the input tensor.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider disabling the tf.raw ops.QuantizeV2 function until a patch is available. Restrict access to the tf.raw ops.QuantizeV2 function to minimize the risk of exploitation. Avoid using the min range and max range parameters in the affected API endpoint until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TENSORFLOW-2021-37663

CVE-2021-37663

GHSA-G25H-JR74-QP5J

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-285

PYSEC-2021-576

PYSEC-2021-774

Affected Products

Tensorflow

References · 88

• https://github.com/tensorflow/tensorflow/commit/6da6620efad397c85493b8f8667b821403516708 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37663 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37663 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g25h-jr74-qp5j · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-774 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-576 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37663 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g25h-jr74-qp5j · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-774.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-285.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-576.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note