PT-2021-23178 · Google · Tensorflow

Mihaimaruseac · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41206

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow version 2.6.1 TensorFlow version 2.5.2 TensorFlow version 2.4.4

Description Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. These issues were discovered internally via tooling while working on improving/testing GPU op determinism.

Recommendations Update to TensorFlow 2.7.0 or later to resolve the issue. For versions 2.6.1, 2.5.2, and 2.4.4, update to the respective cherrypicked commits to resolve the issue. As a temporary workaround, consider restricting the use of affected TensorFlow operations until a patch is available.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

BIT-TENSORFLOW-2021-41206

CVE-2021-41206

GHSA-PGCQ-H79J-2F69

OPENSUSE-SU-2024:12116-1

PYSEC-2021-843

PYSEC-2021-845

PYSEC-2021-847

Affected Products

Tensorflow

References · 20

• https://github.com/tensorflow/tensorflow/commit/e7f497570abb6b4ae5af4970620cd880e4c0c904 · Patch
• https://github.com/tensorflow/tensorflow/commit/da4aad5946be30e5f049920fa076e1f7ef021261 · Patch
• https://github.com/tensorflow/tensorflow/commit/4dddb2fd0b01cdd196101afbba6518658a2c9e07 · Patch
• https://github.com/tensorflow/tensorflow/commit/4d74d8a00b07441cba090a02e0dd9ed385145bf4 · Patch
• https://github.com/tensorflow/tensorflow/commit/68422b215e618df5ad375bcdc6d2052e9fd3080a · Patch
• https://github.com/tensorflow/tensorflow/commit/579261dcd446385831fe4f7457d802a59685121d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41206 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41206 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-843 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-845 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgcq-h79j-2f69 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41206 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-847 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pgcq-h79j-2f69 · Note
• https://github.com/tensorflow/tensorflow · Note