Vulnerability Details : CVE-2021-29614

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `` produces incorrect results and crashes the Python interpreter when combining `fixed_length` and wider datatypes. The implementation of the padded version( is buggy due to a confusion about pointer arithmetic rules. First, the code computes( the width of each output element by dividing the `fixed_length` value to the size of the type argument. The `fixed_length` argument is also used to determine the size needed for the output tensor( This is followed by reencoding code( The erroneous code is the last line above: it is moving the `out_data` pointer by `fixed_length * sizeof(T)` bytes whereas it only copied at most `fixed_length` bytes from the input. This results in parts of the input not being decoded into the output. Furthermore, because the pointer advance is far wider than desired, this quickly leads to writing to outside the bounds of the backing data. This OOB write leads to interpreter crash in the reproducer mentioned here, but more severe attacks can be mounted too, given that this gadget allows writing to periodically placed locations in memory. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability category: Memory Corruption
Published 2021-05-14 20:15:16
Updated 2022-04-25 20:09:41
Source GitHub, Inc.
View at NVD,

Exploit prediction scoring system (EPSS) score for CVE-2021-29614

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 15 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2021-29614

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source

CWE ids for CVE-2021-29614

  • The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
    Assigned by: (Secondary)
  • The product writes data past the end, or before the beginning, of the intended buffer.
    Assigned by: (Primary)

References for CVE-2021-29614

Products affected by CVE-2021-29614

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to terms of use!