CVE-2021-29513
Summary
| CVE | CVE-2021-29513 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-05-14 20:15:00 UTC |
| Updated | 2021-07-26 15:57:00 UTC |
| Description | TensorFlow is an end-to-end open source platform for machine learning. Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. The conversion from Python array to C++ array(https://github.com/tensorflow/tensorflow/blob/ff70c47a396ef1e3cb73c90513da4f5cb71bebba/tensorflow/python/lib/core/ndarray_tensor.cc#L113-L169) is vulnerable to a type confusion. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. |
Risk And Classification
Problem Types: CWE-476 | CWE-843
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Type confusion during tensor casts lead to dereferencing null pointers · Advisory · tensorflow/tensorflow · GitHub | CONFIRM | github.com | |
| Fix `tf.raw_ops.ResourceCountUpTo` null pointer dereference. · tensorflow/tensorflow@030af76 · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982533 Python (pip) Security Update for tensorflow-gpu (GHSA-452g-f7fp-9jf7)