CVE-2021-37664 Heap OOB in boosted trees in TensorFlow

2021-08-1220:25:23

CWE-125

GitHub_M

www.cve.org

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit. The implementation needs to validate that each value in stats_summary_indices is in range. We have patched the issue in GitHub commit e84c975313e8e8e38bb2ea118196369c45c51378. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.5.0, < 2.5.1"
      },
      {
        "status": "affected",
        "version": ">= 2.4.0, < 2.4.3"
      },
      {
        "status": "affected",
        "version": "< 2.3.4"
      }
    ]
  }
]