PT-2021-23176 · Google · Tensorflow

Mihaimaruseac · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41204

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description The issue occurs during TensorFlow's Grappler optimizer phase, where constant folding might attempt to deep copy a resource tensor, resulting in a segfault. This happens because these tensors are supposed to remain unchanged.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 to resolve the issue. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or a later version in the 2.6 series to resolve the issue. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or a later version in the 2.5 series to resolve the issue. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or a later version in the 2.4 series to resolve the issue.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-41204

CVE-2021-41204

GHSA-786J-5QWQ-R36X

OPENSUSE-SU-2024:12116-1

PYSEC-2021-397

PYSEC-2021-614

PYSEC-2021-812

Affected Products

Tensorflow

References · 13

• https://osv.dev/vulnerability/PYSEC-2021-614 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-812 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-786j-5qwq-r36x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41204 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-397 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659 · Note
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-614.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-397.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-812.yaml · Note