CVE-2021-41219
Undefined behavior via `nullptr` reference binding in sparse matrix multiplication
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
TensorFlow es una plataforma de código abierto para el aprendizaje automático. En las versiones afectadas el código para la multiplicación de matrices dispersas es vulnerable a un comportamiento indefinido por medio de la vinculación de una referencia a "nullptr". Esto ocurre siempre que las dimensiones de "a" o "b" sean 0 o menos. En el caso de que una de ellas sea 0, es debido asignar un tensor de salida vacío (para conservar el invariante de que los tensores de salida siempre se asignan cuando la operación presenta éxito) pero no es debido escribir nada en él (es decir, debemos regresar antes de tiempo de la implementación del núcleo). De lo contrario, los intentos de escribir en este tensor vacío resultarían en un acceso OOB a la pila. La corrección será incluida en TensorFlow versión 2.7.0. También será incluida este commit en TensorFlow versión 2.6.1, TensorFlow versión 2.5.2, y TensorFlow versión 2.4.4, ya que estos también están afectados y todavía están en el rango admitido
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-09-15 CVE Reserved
- 2021-11-05 CVE Published
- 2023-05-29 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
- CWE-824: Access of Uninitialized Pointer
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4f99-p9c2-3j8x | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/tensorflow/tensorflow/commit/e6cf28c72ba2eb949ca950d834dd6d66bb01cfae | 2021-11-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | < 2.4.4 Search vendor "Google" for product "Tensorflow" and version " < 2.4.4" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.5.0 < 2.5.2 Search vendor "Google" for product "Tensorflow" and version " >= 2.5.0 < 2.5.2" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.6.0 Search vendor "Google" for product "Tensorflow" and version "2.6.0" | - |
Affected
| ||||||