PT-2021-23195 · Google · Tensorflow

Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41222

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description TensorFlow is an open source platform for machine learning. The implementation of SplitV can trigger a segfault if an attacker supplies negative arguments. This occurs whenever size splits contains more than one value and at least one value is negative.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider avoiding the use of negative arguments in size splits to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

BIT-TENSORFLOW-2021-41222

CVE-2021-41222

GHSA-CPF4-WX82-GXP6

OPENSUSE-SU-2024:12116-1

PYSEC-2021-414

PYSEC-2021-631

PYSEC-2021-829

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cpf4-wx82-gxp6 · Exploit
• https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca3904177579e733cc6 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41222 · Security Note
• https://osv.dev/vulnerability/GHSA-cpf4-wx82-gxp6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-631 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-829 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41222 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-414 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-631.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-829.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-414.yaml · Note
• https://t.me/cvenotify/23227 · Telegram Post
• https://t.me/cibsecurity/31927 · Telegram Post