PT-2021-23169 · Google · Tensorflow

Lugalurimo · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41197

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.0 through 2.6.0 TensorFlow versions 2.5.0 through 2.5.1 TensorFlow versions 2.4.0 through 2.4.3

Description TensorFlow allows tensors to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an int64 t. If an overflow occurs, MultiplyWithoutOverflow would return a negative result, resulting in a CHECK-failure in the majority of the TensorFlow codebase. Newer constructs exist which return a Status instead of crashing the binary. For example, calls to AddDim should be replaced by AddDimWithStatus.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.0 through 2.6.0, update to TensorFlow 2.6.1 or later. For versions 2.5.0 through 2.5.1, update to TensorFlow 2.5.2 or later. For versions 2.4.0 through 2.4.3, update to TensorFlow 2.4.4 or later.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2021-41197

CVE-2021-41197

GHSA-PRCG-WP5Q-RV7P

OPENSUSE-SU-2024:12116-1

PYSEC-2021-390

PYSEC-2021-607

PYSEC-2021-805

Affected Products

Tensorflow

References · 18

• 🔥 https://github.com/tensorflow/tensorflow/issues/51908 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/issues/46890 · Exploit
• https://github.com/tensorflow/tensorflow/commit/d81b1351da3e8c884ff836b64458d94e4a157c15 · Patch
• https://github.com/tensorflow/tensorflow/commit/7c1692bd417eb4f9b33ead749a41166d6080af85 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-prcg-wp5q-rv7p · Patch
• https://github.com/tensorflow/tensorflow/commit/a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf · Patch
• https://osv.dev/vulnerability/PYSEC-2021-607 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41197 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prcg-wp5q-rv7p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41197 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-390 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-805.yaml · Note