CVE-2021-29513

Katalog CVE

CVSS 7.8 · High EPSS 0,20%

Kerentanan NULL Pointer Dereference pada google tensorflow. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

TensorFlow is an end-to-end open source platform for machine learning. Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. The conversion from Python array to C++ array(https://github.com/tensorflow/tensorflow/blob/ff70c47a396ef1e3cb73c90513da4f5cb71bebba/tensorflow/python/lib/core/ndarray_tensor.cc#L113-L169) is vulnerable to a type confusion. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Rincian

Terbit di NVD

14 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/030af767d357d1b4088c4a25c72cb3906abac489 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-452g-f7fp-9jf7 exploit · patch · advisory pihak ketiga