PT-2021-21784 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37667

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can cause undefined behavior via binding a reference to null pointer in tf.raw ops.UnicodeEncode. The implementation reads the first dimension of the input splits tensor before validating that this tensor is not empty.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider avoiding the use of tf.raw ops.UnicodeEncode until a patch is available.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-37667

CVE-2021-37667

GHSA-W74J-V8XH-3W5H

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-289

PYSEC-2021-580

PYSEC-2021-778

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/2e0ee46f1a47675152d3d865797a18358881d7a6 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37667 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37667 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w74j-v8xh-3w5h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-580 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-289 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37667 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w74j-v8xh-3w5h · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-289.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-580.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-778.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note