Vulnerability Details : CVE-2021-37659
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations). The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/cwise_ops_common.h#L264) assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr. We have patched the issue in GitHub commit 93f428fd1768df147171ed674fee1fc5ab8309ec. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Products affected by CVE-2021-37659
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-37659
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-37659
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
7.3
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H |
1.8
|
5.5
|
GitHub, Inc. |
CWE ids for CVE-2021-37659
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: security-advisories@github.com (Primary)
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: security-advisories@github.com (Primary)
References for CVE-2021-37659
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q3g3-h9r4-prrc
Reference binding to nullptr and heap OOB in binary cwise ops · Advisory · tensorflow/tensorflow · GitHubThird Party Advisory
-
https://github.com/tensorflow/tensorflow/commit/93f428fd1768df147171ed674fee1fc5ab8309ec
Fix nullptr deref and heap OOB access in binary cwise ops. · tensorflow/tensorflow@93f428f · GitHubPatch;Third Party Advisory
Jump to