p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in tensorflow-cpu · Seite 18

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für tensorflow-cpu: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 430

  1. CVE-2021-29568

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Reference binding to null in `ParameterizedTruncatedNormal`

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in `tf.raw_ops.ParameterizedTruncatedNormal`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/3f6fe4dfef6f57e768260b48166c27d148f3015f/tensorflow/core/kernels/parameterized_truncated_normal_op.cc#L630) does not validate input arguments before accessing the first element of `shape`. If `shape` argument is empty, then `shape_tensor.flat<T>()` is an empty array. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.0rc0 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.0rc0 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.2 aktualisieren
    • Auf 2.4.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2021-29569

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Heap out of bounds read in `RequantizationRange`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantization_range_op.cc#L49-L50) assumes that the `input_min` and `input_max` tensors have at least one element, as it accesses the first element in two arrays. If the tensors are empty, `.flat<T>()` is an empty object, backed by an empty array. Hence, accesing even the 0th element is

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2021-29570

    Niedrig · CVSS 2.5EPSS 0,15%Korrektur verfügbar

    Heap out of bounds read in `MaxPoolGradWithArgmax`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ef0c008ee84bad91ec6725ddc42091e19a30cf0e/tensorflow/core/kernels/maxpooling_op.cc#L1016-L1017) uses the same value to index in two different arrays but there is no guarantee that the sizes are identical. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorF

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2021-29571

    Mittel · CVSS 4.5EPSS 0,24%Korrektur verfügbar

    Memory corruption in `DrawBoundingBoxesV2`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/31bd5026304677faa8a0b77602c6154171b9aec1/tensorflow/core/kernels/image/draw_bounding_box_op.cc#L116-L130) assumes that the last element of `boxes` input is 4, as required by [the op](https://www.tensorflow.org/api_docs/python/tf/raw_ops/DrawBoundingBoxesV2). Since this is not checked attackers passing values less than 4 can write outside of bounds of

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.0rc0 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.0rc0 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.2 aktualisieren
    • Auf 2.4.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2021-29572

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    Reference binding to nullptr in `SdcaOptimizer`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.SdcaOptimizer` triggers undefined behavior due to dereferencing a null pointer. The implementation(https://github.com/tensorflow/tensorflow/blob/60a45c8b6192a4699f2e2709a2645a751d435cc3/tensorflow/core/kernels/sdca_internal.cc) does not validate that the user supplied arguments satisfy all constraints expected by the op(https://www.tensorflow.org/api_docs/python/tf/raw_ops/SdcaOptimizer). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2021-29573

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    Division by 0 in `MaxPoolGradWithArgmax`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` is vulnerable to a division by 0. The implementation(https://github.com/tensorflow/tensorflow/blob/279bab6efa22752a2827621b7edb56a730233bd8/tensorflow/core/kernels/maxpooling_op.cc#L1033-L1034) fails to validate that the batch dimension of the tensor is non-zero, before dividing by this quantity. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2021-29574

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Undefined behavior in `MaxPool3DGradGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPool3DGradGrad` exhibits undefined behavior by dereferencing null pointers backing attacker-supplied empty tensors. The implementation(https://github.com/tensorflow/tensorflow/blob/72fe792967e7fd25234342068806707bbc116618/tensorflow/core/kernels/pooling_ops_3d.cc#L679-L703) fails to validate that the 3 tensor inputs are not empty. If any of them is empty, then accessing the elements in the tensor results in dereferencing a null pointer. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2021-29575

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Overflow/denial of service in `tf.raw_ops.ReverseSequence`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service. The implementation(https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that `seq_dim` and `batch_dim` arguments are valid. Negative values for `seq_dim` can result in stack overflow or `CHECK`-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of `batch_dim`. The

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.0rc0 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2021-29576

    Niedrig · CVSS 2.5EPSS 0,21%Korrektur verfügbar

    Heap buffer overflow in `MaxPool3DGradGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPool3DGradGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L694-L696) does not check that the initialization of `Pool3dParameters` completes successfully. Since the constructor(https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L48-L88) uses `OP_REQUIRES` to validate conditions, the first assertion that fails interru

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2021-29577

    Niedrig · CVSS 2.5EPSS 0,21%Korrektur verfügbar

    Heap buffer overflow in `AvgPool3DGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.AvgPool3DGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/d80ffba9702dc19d1fac74fc4b766b3fa1ee976b/tensorflow/core/kernels/pooling_ops_3d.cc#L376-L450) assumes that the `orig_input_shape` and `grad` tensors have similar first and last dimensions but does not check that this assumption is validated. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affe

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2021-29578

    Niedrig · CVSS 2.5EPSS 0,21%Korrektur verfügbar

    Heap buffer overflow in `FractionalAvgPoolGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalAvgPoolGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/dcba796a28364d6d7f003f6fe733d82726dda713/tensorflow/core/kernels/fractional_avg_pool_op.cc#L216) fails to validate that the pooling sequence arguments have enough elements as required by the `out_backprop` tensor shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2021-29579

    Niedrig · CVSS 2.5EPSS 0,21%Korrektur verfügbar

    Heap buffer overflow in `MaxPoolGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/ab1e644b48c82cb71493f4362b4dd38f4577a1cf/tensorflow/core/kernels/maxpooling_op.cc#L194-L203) fails to validate that indices used to access elements of input/output arrays are valid. Whereas accesses to `input_backprop_flat` are guarded by `FastBoundsCheck`, the indexing in `out_backprop_flat` can result in OOB access. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, Ten

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2021-29580

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalMaxPoolGrad` triggers an undefined behavior if one of the input tensors is empty. The code is also vulnerable to a denial of service attack as a `CHECK` condition becomes false and aborts the process. The implementation(https://github.com/tensorflow/tensorflow/blob/169054888d50ce488dfde9ca55d91d6325efbd5b/tensorflow/core/kernels/fractional_max_pool_op.cc#L215) fails to validate that input and output tensors are not empty and are of the same rank. Each of these unchecked assumptions is responsible for the above issues. The fix wil

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2021-29581

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    Segfault in `CTCBeamSearchDecoder`

    TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults. The implementation(https://github.com/tensorflow/tensorflow/blob/a74768f8e4efbda4def9f16ee7e13cf3922ac5f7/tensorflow/core/kernels/ctc_decoder_ops.cc#L68-L79) fails to detect cases when the input tensor is empty and proceeds to read data from a null buffer. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2021-29582

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Heap OOB read in `tf.raw_ops.Dequantize`

    TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.Dequantize`, an attacker can trigger a read from outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/26003593aa94b1742f34dc22ce88a1e17776a67d/tensorflow/core/kernels/dequantize_op.cc#L106-L131) accesses the `min_range` and `max_range` tensors in parallel but fails to check that they have the same shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2021-29583

    Niedrig · CVSS 2.5EPSS 0,21%Korrektur verfügbar

    Heap buffer overflow and undefined behavior in `FusedBatchNorm`

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation(https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc) fails to validate that `scale`, `offset`, `mean` and `variance` (the last two only when required) all have the same number of elements as the number of channels of `x`. This results in heap out of bounds reads when the bu

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.0rc0 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.0rc0 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.3.4 aktualisieren
    • Auf 2.4.2 aktualisieren
    • Auf 2.4.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2021-29584

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    CHECK-fail due to integer overflow

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in caused by an integer overflow in constructing a new tensor shape. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/0908c2f2397c099338b901b067f6495a5b96760b/tensorflow/core/kernels/sparse_split_op.cc#L66-L70) builds a dense shape without checking that the dimensions would not result in overflow. The `TensorShape` constructor(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L183-L188) uses a `CHECK`

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2021-29525

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Division by 0 in `Conv2DBackpropInput`

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropInput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/b40060c9f697b044e3107917c797ba052f4506ab/tensorflow/core/kernels/conv_grad_input_ops.h#L625-L655) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2021-29526

    Niedrig · CVSS 2.5EPSS 0,2%Korrektur verfügbar

    Division by 0 in `Conv2D`

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.Conv2D`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/988087bd83f144af14087fe4fecee2d250d93737/tensorflow/core/kernels/conv_ops.cc#L261-L263) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2021-29527

    Niedrig · CVSS 2.5EPSS 0,19%Korrektur verfügbar

    Division by 0 in `QuantizedConv2D`

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedConv2D`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/00e9a4d67d76703fa1aee33dac582acf317e0e81/tensorflow/core/kernels/quantized_conv_ops.cc#L257-L259) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

    tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpu tensorflow-cpuPython
    • Auf 2.1.4 aktualisieren
    • Auf 2.2.3 aktualisieren
    • Auf 2.3.3 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →