PT-2021-21788 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37670

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.raw ops.UpperBound. The implementation does not validate the rank of sorted input argument. A similar issue occurs in tf.raw ops.LowerBound.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider disabling the tf.raw ops.UpperBound and tf.raw ops.LowerBound functions until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2021-37670

CVE-2021-37670

GHSA-9697-98PF-4RW7

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-292

PYSEC-2021-583

PYSEC-2021-781

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/42459e4273c2e47a3232cc16c4f4fff3b3a35c38 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37670 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37670 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-781 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37670 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9697-98pf-4rw7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-292 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9697-98pf-4rw7 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-781.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-583.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-292.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note