CVE-2021-29569
- Source
- https://cve.org/CVERecord?id=CVE-2021-29569
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29569.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-29569
- Aliases
- Related
- Published
- 2021-05-14T20:15:13.790Z
- Modified
- 2026-02-05T06:36:13.002861Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
TensorFlow is an end-to-end open source platform for machine learning. The implementation of
tf.raw_ops.MaxPoolGradWithArgmaxcan cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantizationrangeop.cc#L49-L50) assumes that theinput_minandinput_maxtensors have at least one element, as it accesses the first element in two arrays. If the tensors are empty,.flat<T>()is an empty object, backed by an empty array. Hence, accesing even the 0th element is a read outside the bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. - References
-
- https://github.com/tensorflow/tensorflow/commit/ef0c008ee84bad91ec6725ddc42091e19a30cf0e
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3h8m-483j-7xxm
- https://github.com/tensorflow/tensorflow/commit/ef0c008ee84bad91ec6725ddc42091e19a30cf0e
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3h8m-483j-7xxm
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3h8m-483j-7xxm
Affected packages
Git / github.com/tensorflow/tensorflow
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tensorflow/tensorflow
- Events
-
FixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29569.json"
vanir_signatures
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tensorflow/tensorflow/commit/ef0c008ee84bad91ec6725ddc42091e19a30cf0e",
"digest": {
"line_hashes": [
"180716207430583673823796956875046262203",
"334337635383405665068979157611230155636",
"118583936821414970937919024587845428764",
"7278528345410478855156165783837882651"
],
"threshold": 0.9
},
"id": "CVE-2021-29569-a87c044c",
"deprecated": false,
"target": {
"file": "tensorflow/core/kernels/requantization_range_op.cc"
}
}
]