PT-2021-21792 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37674

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can trigger a denial of service via a segmentation fault in tf.raw ops.MaxPoolGrad caused by missing validation for the orig input and orig output tensors. The issue arises from incomplete fixes for a previous problem.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider disabling the tf.raw ops.MaxPoolGrad function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-1284

Related Identifiers

BIT-TENSORFLOW-2021-37674

CVE-2021-37674

GHSA-7GHQ-FVR3-PJ2X

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-296

PYSEC-2021-587

PYSEC-2021-785

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-785 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7ghq-fvr3-pj2x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37674 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-587 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37674 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37674 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-068.md · Note
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7ghq-fvr3-pj2x · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-296.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-785.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-587.yaml · Note