CVE-2021-29520

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-29520

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29520.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-29520

Aliases

Published

2021-05-14T20:15:11.523Z

Modified

2026-03-10T23:45:19.078411706Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

TensorFlow is an end-to-end open source platform for machine learning. Missing validation between arguments to tf.raw_ops.Conv3DBackprop* operations can result in heap buffer overflows. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/4814fafb0ca6b5ab58a09411523b2193fed23fed/tensorflow/core/kernels/convgradshape_utils.cc#L94-L153) assumes that the input, filter_sizes and out_backprop tensors have the same shape, as they are accessed in parallel. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type

GIT

Repo

https://github.com/tensorflow/tensorflow

Events

Introduced

Fixed

0931ea3d985bb9c8fdd054a5e29c4129623c849b

Introduced

2b96f3662bd776e277f86997659e61046b56c315

Fixed

cfe0c80169ae984bcdc99ff6de7444164aaa8e07

Introduced

b36436b087bd8e8701ef51718179037cccdfc26e

Fixed

3929ffacfbef7c431e8397920d040aaf47acff19

Introduced

582c8d236cb079023657287c318ff26adb239002

Fixed

1923123d32ea41d92b70a27a3f6ecf0763b56f6c

Fixed

8f37b52e1320d8d72a9529b2468277791a261197

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.4"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.3"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.3"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "2.4.2"
        }
    ]
}

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2021-29520-b46264af",
        "source": "https://github.com/tensorflow/tensorflow/commit/8f37b52e1320d8d72a9529b2468277791a261197",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130346267694675239555962600015314064582",
                "1870812638792796020272407030061161348",
                "80959905309595320023499196112532347190",
                "130346267694675239555962600015314064582",
                "1870812638792796020272407030061161348",
                "80959905309595320023499196112532347190",
                "324257722938086065981925465050320693107",
                "158659948036379636259671468535571406635",
                "324802294671987906275561130619732475302",
                "324257722938086065981925465050320693107",
                "158659948036379636259671468535571406635",
                "324802294671987906275561130619732475302"
            ]
        },
        "signature_version": "v1",
        "target": {
            "file": "tensorflow/core/kernels/conv_grad_ops_3d.cc"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29520.json"