PT-2021-21783 · Google · Tensorflow

Mihaimaruseac

·

Published

2021-08-12

·

Updated

2024-03-06

·

CVE-2021-37666

CVSS v4.0

8.5

High

VectorAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier
Description An attacker can cause undefined behavior via binding a reference to null pointer in tf.raw ops.RaggedTensorToVariant. The implementation has an incomplete validation of the splits values, missing the case when the argument would be empty. This can be exploited by passing empty rt nested splits to tf.raw ops.RaggedTensorToVariant, as shown in the example:
import tensorflow as tf

tf.raw ops.RaggedTensorToVariant(
 rt nested splits=[],
 rt dense values=[1,2,3],
 batched input=True)
The issue is due to the missing validation of the rt nested splits argument.
Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider validating the rt nested splits argument before passing it to tf.raw ops.RaggedTensorToVariant to prevent empty values.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-37666
CVE-2021-37666
GHSA-W4XF-2PQW-5MQ7
OPENSUSE-SU-2022:10014-1
OPENSUSE-SU-2024:12116-1
PYSEC-2021-288
PYSEC-2021-579
PYSEC-2021-777

Affected Products

Tensorflow