ID |
CVE-2021-29521
|
Summary |
TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L199-L213) assumes the first element of the dense shape is always positive and uses it to initialize a `BatchedMap<T>` (i.e., `std::vector<absl::flat_hash_map<int64,T>>`(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L27)) data structure. If the `shape` tensor has more than one element, `num_batches` is the first value in `shape`. Ensuring that the `dense_shape` argument is a valid tensor shape (that is, all elements are non-negative) solves this issue. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:google:tensorflow:2.3.0:-:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.0:-:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.3.0:rc0:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.0:rc0:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.0:rc1:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.3.0:rc2:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.0:rc2:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.1:*:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.3.2:*:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:*:*:*:*
-
cpe:2.3:a:google:tensorflow:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:google:tensorflow:2.4.1:*:*:*:*:*:*:*
|
CVSS |
Base: | 2.1 (as of 20-05-2021 - 17:19) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-131 |
CAPEC |
-
Buffer Overflow via Parameter Expansion
In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
-
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.
|
Access |
Vector | Complexity | Authentication |
LOCAL |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
NONE |
NONE |
PARTIAL |
|
cvss-vector
via4
|
AV:L/AC:L/Au:N/C:N/I:N/A:P
|
Last major update |
20-05-2021 - 17:19 |
Published |
14-05-2021 - 20:15 |
Last modified |
20-05-2021 - 17:19 |