PT-2021-21790 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37672

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.raw ops.SdcaOptimizerV2. The implementation does not check that the length of example labels is the same as the number of examples.

Recommendations For TensorFlow versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For TensorFlow versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For TensorFlow versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For TensorFlow versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider restricting the use of tf.raw ops.SdcaOptimizerV2 until a patch is available. Avoid using the example labels parameter in the affected API endpoint until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2021-37672

CVE-2021-37672

GHSA-5HJ3-VJJF-F5M7

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-294

PYSEC-2021-585

PYSEC-2021-783

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/a4e138660270e7599793fa438cd7b2fc2ce215a6 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37672 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-585 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hj3-vjjf-f5m7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-294 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37672 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-783 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5hj3-vjjf-f5m7 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-783.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-585.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-294.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note