CVE-2021-29568 Reference binding to null in `ParameterizedTruncatedNormal`

2021-05-1419:16:41

CWE-824

GitHub_M

www.cve.org

tensorflow

security vulnerability

pointer binding

data validation

tensorflow 2.5.0

patch application

CVSS3

2.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

20.9%

JSON

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in tf.raw_ops.ParameterizedTruncatedNormal. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/3f6fe4dfef6f57e768260b48166c27d148f3015f/tensorflow/core/kernels/parameterized_truncated_normal_op.cc#L630) does not validate input arguments before accessing the first element of shape. If shape argument is empty, then shape_tensor.flat<T>() is an empty array. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.1.4"
      },
      {
        "status": "affected",
        "version": ">= 2.2.0, < 2.2.3"
      },
      {
        "status": "affected",
        "version": ">= 2.3.0, < 2.3.3"
      },
      {
        "status": "affected",
        "version": ">= 2.4.0, < 2.4.2"
      }
    ]
  }
]