PT-2021-21801 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37682

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description The issue affects all TFLite operations that use quantization, allowing them to use uninitialized values. This stems from missing checks for quantization.params validity, which is only valid if quantization.type is different from kTfLiteNoQuantization. The problem arises from the lack of these checks in large parts of the code.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider restricting the use of quantization in TFLite operations until a patch is available.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

BIT-TENSORFLOW-2021-37682

CVE-2021-37682

GHSA-4C4G-CRQM-XRXW

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-304

PYSEC-2021-595

PYSEC-2021-793

Affected Products

Tensorflow

References · 90

• https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538 · Patch
• https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 · Patch
• https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37682 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-595 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c4g-crqm-xrxw · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37682 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37682 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-304 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-793 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxw · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-304.yaml · Note