CVE-2021-37671

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-37671
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37671.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-37671
Aliases
Downstream
Related
Published
2021-08-12T22:15:08.440Z
Modified
2026-02-13T08:45:35.617302Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in tf.raw_ops.Map* and tf.raw_ops.OrderedMap* operations. The implementation has a check in place to ensure that indices is in ascending order, but does not check that indices is not empty. We have patched the issue in GitHub commit 532f5c5a547126c634fefd43bbad1dc6417678ac. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
532f5c5a547126c634fefd43bbad1dc6417678ac
Introduced
582c8d236cb079023657287c318ff26adb239002
Fixed
4c0b84bf2a714bcdd18da1f1f94d533d72399d52
Introduced
b36436b087bd8e8701ef51718179037cccdfc26e
Fixed
7462dcaae1e8cfe1dfd0c62dd6083f9749a9d827

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37671.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tensorflow/tensorflow/commit/532f5c5a547126c634fefd43bbad1dc6417678ac",
        "digest": {
            "line_hashes": [
                "101270794011391990960273166363886381699",
                "127567948000679501096689160476919037159",
                "283873026211747067522129611499356494408",
                "199550947259889392532635302582293019756",
                "101692540017467017766872335871265843648",
                "325935887256889070731197183047988204613",
                "185041216772895998777906462325282620652",
                "251826227174176876517082477910448041335",
                "202229951261415798519556149708101139418",
                "324059966233205313228581230177752822721",
                "209798581753765881305378150538004968962",
                "97334924217345854418038715912586586563",
                "11484242756864040319387314600609541995",
                "320540121400502850523022069923505129763",
                "48142271025788149745820039806993843858",
                "15375361714468426007494293680261077320",
                "52021494098927027454794326476115537243",
                "57944569019607461775153761753527151447",
                "157109492641608684762227177061837983847",
                "86356617569703579789284666717648540443",
                "320884592715409454363198810760046893823",
                "289192258019031814832220644887238772370"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-37671-6f9a8b7a",
        "deprecated": false,
        "target": {
            "file": "tensorflow/core/kernels/map_stage_op.cc"
        }
    }
]