PT-2021-23188 · Google · Tensorflow

Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41215

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description The shape inference code for DeserializeSparse can trigger a null pointer dereference. This occurs because the shape inference function assumes that the serialize sparse tensor is a tensor with positive rank and having 3 as the last dimension. However, if the argument is a scalar, it can cause the issue.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider avoiding the use of the DeserializeSparse function with scalar arguments until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2021-41215

CVE-2021-41215

GHSA-X3V8-C8QX-3J3R

OPENSUSE-SU-2024:12116-1

PYSEC-2021-407

PYSEC-2021-624

PYSEC-2021-822

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x3v8-c8qx-3j3r · Exploit
• https://github.com/tensorflow/tensorflow/commit/d3738dd70f1c9ceb547258cbb82d853da8771850 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-822 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41215 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3v8-c8qx-3j3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41215 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41215 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-407 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-624 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-624.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-822.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-407.yaml · Note