CVE-2021-29521

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Incorrect Calculation of Buffer Size pada google tensorflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L199-L213) assumes the first element of the dense shape is always positive and uses it to initialize a `BatchedMap<T>` (i.e., `std::vector<absl::flat_hash_map<int64,T>>`(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L27)) data structure. If the `shape` tensor has more than one element, `num_batches` is the first value in `shape`. Ensuring that the `dense_shape` argument is a valid tensor shape (that is, all elements are non-negative) solves this issue. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3.

Rincian

Terbit di NVD

14 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hr84-fqvp-48mm exploit · patch · advisory pihak ketiga