CVE-2021-37666
Reference binding to nullptr in `RaggedTensorToVariant` in TensorFlow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty. We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
TensorFlow es una plataforma de código abierto de extremo a extremo para el aprendizaje automático. En las versiones afectadas un atacante puede causar un comportamiento indefinido por medio de la vinculación de una referencia a un puntero null en "tf.raw_ops.RaggedTensorToVariant". La [implementación](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) presenta una comprobación incompleta de los valores de división, omitiendo el caso cuando el argumento estaría vacío. Hemos parcheado el problema en el commit be7a4de6adfbd303ce08be4332554dff70362612 de GitHub. La corrección será incluida en TensorFlow versión 2.6.0. También seleccionaremos este commit en TensorFlow versión 2.5.1, TensorFlow versión 2.4.3, y TensorFlow versión 2.3.4, ya que estos también están afectados y todavía están en el rango de soporte.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-07-29 CVE Reserved
- 2021-08-12 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-824: Access of Uninitialized Pointer
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w4xf-2pqw-5mq7 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/tensorflow/tensorflow/commit/be7a4de6adfbd303ce08be4332554dff70362612 | 2021-08-18 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.3.0 < 2.3.4 Search vendor "Google" for product "Tensorflow" and version " >= 2.3.0 < 2.3.4" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.4.0 < 2.4.3 Search vendor "Google" for product "Tensorflow" and version " >= 2.4.0 < 2.4.3" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.5.0 Search vendor "Google" for product "Tensorflow" and version "2.5.0" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.6.0 Search vendor "Google" for product "Tensorflow" and version "2.6.0" | rc0 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.6.0 Search vendor "Google" for product "Tensorflow" and version "2.6.0" | rc1 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.6.0 Search vendor "Google" for product "Tensorflow" and version "2.6.0" | rc2 |
Affected
| ||||||