PT-2021-23187 · Google · Tensorflow

Mihaimaruseac · Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41214

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.0 through 2.6.0 (will be fixed in 2.6.1) TensorFlow versions 2.5.0 through 2.5.1 (will be fixed in 2.5.2) TensorFlow versions 2.4.0 through 2.4.3 (will be fixed in 2.4.4)

Description The shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. This results in a crash when using the tf.ragged.cross function with specific inputs, such as tf.ragged.cross([tf.ragged.constant([['1']]), '2']). The issue is caused by the tf.ragged.cross function and can be exploited in certain scenarios.

Recommendations For TensorFlow versions prior to 2.7.0, update to version 2.7.0 or later. For TensorFlow versions 2.6.0 through 2.6.0, update to version 2.6.1 or later. For TensorFlow versions 2.5.0 through 2.5.1, update to version 2.5.2 or later. For TensorFlow versions 2.4.0 through 2.4.3, update to version 2.4.4 or later. As a temporary workaround, consider avoiding the use of the tf.ragged.cross function until a patch is available.

Exploit

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BIT-TENSORFLOW-2021-41214

CVE-2021-41214

GHSA-VWHQ-49R4-GJ9V

OPENSUSE-SU-2024:12116-1

PYSEC-2021-406

PYSEC-2021-623

PYSEC-2021-821

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vwhq-49r4-gj9v · Exploit
• https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8 · Patch
• https://osv.dev/vulnerability/GHSA-vwhq-49r4-gj9v · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41214 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41214 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-821 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41214 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-406 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-623.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-406.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-821.yaml · Note