PT-2021-21791 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37673

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can trigger a denial of service via a CHECK-fail in tf.raw ops.MapStage. The implementation does not check that the key input is a valid non-empty tensor.

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow versions 2.5.1 and earlier, update to version 2.5.1 or later. For TensorFlow versions 2.4.3 and earlier, update to version 2.4.3 or later. For TensorFlow versions 2.3.4 and earlier, update to version 2.3.4 or later. As a temporary workaround, consider validating the key input to ensure it is a valid non-empty tensor before passing it to tf.raw ops.MapStage.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TENSORFLOW-2021-37673

CVE-2021-37673

GHSA-278G-RQ84-9HMG

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-295

PYSEC-2021-586

PYSEC-2021-784

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37673 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-278g-rq84-9hmg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-295 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37673 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-586 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-784 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-278g-rq84-9hmg · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-784.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-586.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-295.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note