PT-2021-23180 · Google · Tensorflow

Mihaimaruseac · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41208

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing nullptrs or via CHECK-failures) as well as abuse undefined behavior (binding references to nullptrs). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommended to no longer use these APIs.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider disabling the boosted trees APIs until a patch is available. Restrict access to the vulnerable APIs to minimize the risk of exploitation. Avoid using the vulnerable APIs in the affected versions until the issue is resolved.

Fix

Access of Uninitialized Pointer

NULL Pointer Dereference

Weakness Enumeration

CWE-824

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-41208

CVE-2021-41208

GHSA-57WX-M983-2F88

OPENSUSE-SU-2024:12116-1

PYSEC-2021-400

PYSEC-2021-617

PYSEC-2021-815

Affected Products

Tensorflow

References · 16

• https://github.com/tensorflow/tensorflow/commit/5c8c9a8bfe750f9743d0c859bae112060b216f5c · Patch
• https://osv.dev/vulnerability/CVE-2021-41208 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41208 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41208 · Security Note
• https://osv.dev/vulnerability/GHSA-57wx-m983-2f88 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-400 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-815 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-57wx-m983-2f88 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-617.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-400.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-815.yaml · Note
• https://t.me/cibsecurity/31931 · Telegram Post
• https://t.me/cvenotify/23080 · Telegram Post