PT-2021-23172 · Google · Tensorflow

Mihaimaruseac · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41200

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description In affected versions, if tf.summary.create file writer is called with non-scalar arguments, the code crashes due to a CHECK-fail. The issue is related to the tf.summary.create file writer function, which is used for creating a summary file writer. When this function is called with non-scalar arguments, it causes the code to crash.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later to resolve the issue. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later to resolve the issue. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later to resolve the issue. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of non-scalar arguments with the tf.summary.create file writer function until a patch is available.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-TENSORFLOW-2021-41200

CVE-2021-41200

GHSA-GH8H-7J2J-QV4F

OPENSUSE-SU-2024:12116-1

PYSEC-2021-393

PYSEC-2021-610

PYSEC-2021-808

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gh8h-7j2j-qv4f · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/issues/46909 · Exploit
• https://github.com/tensorflow/tensorflow/commit/874bda09e6702cd50bac90b453b50bcc65b2769e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41200 · Security Note
• https://osv.dev/vulnerability/GHSA-gh8h-7j2j-qv4f · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-393 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41200 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-808 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-610 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-610.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-393.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-808.yaml · Note