CVE-2021-29521
CVE-2021-29521 · Segfault in SparseCountSparseOutput
This page contains facts from public vulnerability sources. Check the original advisory before updating.
TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L199-L213) assumes the first element of the dense shape is always positive and uses it to initialize a `BatchedMap<T>` (i.e., `std::vector<absl::flat_hash_map<int64,T>>`(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L27)) data structure. If the `shape` tensor has more than one element, `num_batches` is the first value in `shape`. Ensuring that the `dense_shape` argument is a valid tensor shape (that is, all elements are non-negative) solves this issue. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3.
CVSS 2.5 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
tensorflow
- Versions
- < 2.3.3: Affected
- >= 2.4.0, < 2.4.2: Affected
No fix published
tensorflow PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3
Update to 2.3.3
tensorflow PyPI
- Versions
- 2.4.0
- 2.4.1
- Affected ranges
- ECOSYSTEM: ≥ 2.4.0, < 2.4.2
Update to 2.4.2
tensorflow-cpu PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3
Update to 2.3.3
tensorflow-cpu PyPI
- Versions
- 2.4.0
- 2.4.1
- Affected ranges
- ECOSYSTEM: ≥ 2.4.0, < 2.4.2
Update to 2.4.2
tensorflow-gpu PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3
Update to 2.3.3
tensorflow-gpu PyPI
- Versions
- 2.4.0
- 2.4.1
- Affected ranges
- ECOSYSTEM: ≥ 2.4.0, < 2.4.2
Update to 2.4.2
tensorflow PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.4.1
- Affected ranges
- GIT: < c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3 ∪ ≥ 2.4.0, < 2.4.2
Update to 2.3.3; Update to 2.4.2
tensorflow-cpu PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.4.1
- Affected ranges
- GIT: < c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3 ∪ ≥ 2.4.0, < 2.4.2
Update to 2.3.3; Update to 2.4.2
tensorflow-gpu PyPI
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.4.1
- Affected ranges
- GIT: < c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5
- ECOSYSTEM: ≥ 2.3.0, < 2.3.3 ∪ ≥ 2.4.0, < 2.4.2
Update to 2.3.3; Update to 2.4.2