Lucene search

K
githubGitHub Advisory DatabaseGHSA-G4H2-GQM3-C9WQ
HistoryMay 21, 2021 - 2:23 p.m.

Segfault in tf.raw_ops.ImmutableConst

2021-05-2114:23:05
CWE-681
GitHub Advisory Database
github.com
15

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

12.8%

Impact

Calling tf.raw_ops.ImmutableConst with a dtype of tf.resource or tf.variant results in a segfault in the implementation as code assumes that the tensor contents are pure scalars.

>>> import tensorflow as tf
>>> tf.raw_ops.ImmutableConst(dtype=tf.resource, shape=[], memory_region_name="/tmp/test.txt")
...
Segmentation fault

Patches

We have patched the issue in 4f663d4b8f0bec1b48da6fa091a7d29609980fa4 and will release TensorFlow 2.5.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Workarounds

If using tf.raw_ops.ImmutableConst in code, you can prevent the segfault by inserting a filter for the dtype argument.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Affected configurations

Vulners
Node
tensorflowgpuRange<2.4.2
OR
tensorflowgpuRange<2.3.3
OR
tensorflowgpuRange<2.2.3
OR
tensorflowgpuRange<2.1.4
OR
tensorflowcpuRange<2.4.2
OR
tensorflowcpuRange<2.3.3
OR
tensorflowcpuRange<2.2.3
OR
tensorflowcpuRange<2.1.4
OR
tensorflowtensorflowRange<2.4.2
OR
tensorflowtensorflowRange<2.3.3
OR
tensorflowtensorflowRange<2.2.3
OR
tensorflowtensorflowRange<2.1.4

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

12.8%

Related for GHSA-G4H2-GQM3-C9WQ