ByteOS Network

NVD Vulnerability Details :

CVE-2021-29592

Analyzed

Source-security-advisories@github.com

Published At-14 May, 2021 | 20:15

Updated At-19 May, 2021 | 16:28

TensorFlow is an end-to-end open source platform for machine learning. The fix for CVE-2020-15209(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209) missed the case when the target shape of `Reshape` operator is given by the elements of a 1-D tensor. As such, the fix for the vulnerability(https://github.com/tensorflow/tensorflow/blob/9c1dc920d8ffb4893d6c9d27d1f039607b326743/tensorflow/lite/core/subgraph.cc#L1062-L1074) allowed passing a null-buffer-backed tensor with a 1D shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary	2.0	4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Google LLC

>>tensorflow>>Versions before 2.1.4(exclusive)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Google LLC

>>tensorflow>>Versions from 2.2.0(inclusive) to 2.2.3(exclusive)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Google LLC

>>tensorflow>>Versions from 2.3.0(inclusive) to 2.3.3(exclusive)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Google LLC

>>tensorflow>>Versions from 2.4.0(inclusive) to 2.4.2(exclusive)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-476	Primary	nvd@nist.gov
CWE-476	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/tensorflow/tensorflow/commit/f8378920345f4f4604202d4ab15ef64b2aceaa16	security-advisories@github.com	Patch Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jjr8-m8g8-p6wv	security-advisories@github.com	Exploit Patch Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History