PT-2021-21794 · Google · Tensorflow

Yakun Zhang · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37676

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can cause undefined behavior via binding a reference to null pointer in tf.raw ops.SparseFillEmptyRows. The shape inference implementation does not validate that the input arguments are not empty tensors.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider avoiding the use of tf.raw ops.SparseFillEmptyRows until a patch is available.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-37676

CVE-2021-37676

GHSA-V768-W7M9-2VMM

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-298

PYSEC-2021-589

PYSEC-2021-787

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/578e634b4f1c1c684d4b4294f9e5281b2133b3ed · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-787 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37676 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37676 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37676 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v768-w7m9-2vmm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-589 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-v768-w7m9-2vmm · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-589.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-298.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-787.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note