CVE-2021-29544

Katalog CVE

CVSS 5.5 · Medium EPSS 0,31%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada google tensorflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`. This is because the implementation does not validate the rank of the `input_*` tensors. In turn, this results in the tensors being passes as they are to `QuantizeAndDequantizePerChannelGradientImpl`. However, the `vec<T>` method, requires the rank to 1 and triggers a `CHECK` failure otherwise. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.

Rincian

Terbit di NVD

14 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/20431e9044cf2ad3c0323c34888b192f3289af6b patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6g85-3hm8-83f9 exploit · patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels...
• https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels...