CVE-2021-41202 Overflow/crash in `tf.range`

2021-11-0521:45:18

CWE-681

GitHub_M

www.cve.org

cve-2021-41202

tensorflow

machine learning

conditional statement

implicit conversion

c++

overflow

fix

cherrypick

kernel

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

14.2%

JSON

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition will be cast to double and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.6.0, < 2.6.1"
      },
      {
        "status": "affected",
        "version": ">= 2.5.0, < 2.5.2"
      },
      {
        "status": "affected",
        "version": "< 2.4.4"
      }
    ]
  }
]