PT-2021-21810 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37690

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description TensorFlow is an end-to-end open source platform for machine learning. In affected versions, when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them, but it was not doing the same for shapes and types.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later. As a temporary workaround, consider disabling the MutableHashTableShape function until a patch is available. Restrict access to the ShapeAndType struct to minimize the risk of exploitation. Avoid using the ShapeRefiner function with shapes and types until the issue is resolved.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-TENSORFLOW-2021-37690

CVE-2021-37690

GHSA-3HXH-8CP2-G4HG

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-312

PYSEC-2021-603

PYSEC-2021-801

Affected Products

Tensorflow

References · 89

• https://github.com/tensorflow/tensorflow/commit/ee119d4a498979525046fba1c3dd3f13a039fbb1 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37690 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hxh-8cp2-g4hg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-603 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37690 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37690 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-312 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3hxh-8cp2-g4hg · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-603.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-312.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-801.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note