Vulnerability in Google Tensorflow
CVE-2021-37656
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/ragged_tensor_to_sparse_kernel.cc#L30) has an incomplete validation of the splits values: it does not check that they are in increasing order. We have patched the issue in GitHub commit 1071f554dbd09f7e101324d366eec5f4fe5a3ece. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
EPSS: 0.002 (6.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Google Tensorflow — versions 2.5.0, 2.6.0
- Tensorflow — versions >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-37656?
- CVE-2021-37656 is a high-severity vulnerability in Google Tensorflow, classified under Access of Uninitialized Pointer. CVSS score: 7.1/10. Published 2021-08-12.
- How severe is CVE-2021-37656?
- High severity. CVSS v3 base score is 7.1 out of 10.