Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-29611

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6ea5f48415854223285/tensorflow/core/kernels/sparse_reshape_op.cc#L40) has no validation that the input arguments specify a valid sparse tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

Published

2021-05-14T20:15:15.947

Last Modified

2024-11-21T06:01:29.440

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.6 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-665
Type: Primary
CWE-20

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	google	tensorflow	< 2.1.4	Yes
Application	google	tensorflow	< 2.2.3	Yes
Application	google	tensorflow	< 2.3.3	Yes
Application	google	tensorflow	< 2.4.2	Yes

References

https://github.com/tensorflow/tensorflow/commit/1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6 Patch, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9rpc-5v9q-5r7f Exploit, Patch, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/commit/1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9rpc-5v9q-5r7f Exploit, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)