Lucene search

K
cvelistGitHub_MCVELIST:CVE-2021-29519
HistoryMay 14, 2021 - 7:35 p.m.

CVE-2021-29519 CHECK-fail in SparseCross due to type confusion

2021-05-1419:35:58
CWE-843
GitHub_M
raw.githubusercontent.com
1

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.3%

TensorFlow is an end-to-end open source platform for machine learning. The API of tf.raw_ops.SparseCross allows combinations which would result in a CHECK-failure and denial of service. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/kernels/sparse_cross_op.cc#L114-L116) is tricked to consider a tensor of type tstring which in fact contains integral elements. Fixing the type confusion by preventing mixing DT_STRING and DT_INT64 types solves this issue. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.3%

Related for CVELIST:CVE-2021-29519