CVE-2021-37676

Katalog CVE

CVSS 7.8 · High EPSS 0,17%

Kerentanan Access of Uninitialized Pointer pada google tensorflow. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.SparseFillEmptyRows`. The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/sparse_ops.cc#L608-L634) does not validate that the input arguments are not empty tensors. We have patched the issue in GitHub commit 578e634b4f1c1c684d4b4294f9e5281b2133b3ed. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Rincian

Terbit di NVD

12 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-824: Access of Uninitialized Pointer

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/578e634b4f1c1c684d4b4294f9e5281b2133b3ed patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-v768-w7m9-2vmm advisory pihak ketiga