Skip to content
OpenAdvisories
Low · 2.5 CVE-2021-29551 BIT-tensorflow-2021-29551EUVD-2021-0292GHSA-vqw6-72r7-fgw7PYSEC-2021-188PYSEC-2021-479PYSEC-2021-677

OOB read in `MatrixTriangularSolve`

Published May 14, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Vendor: TensorFlow Product: TensorFlow Package: tensorflow Package: tensorflow-cpu Package: tensorflow-gpu Ecosystem: PyPI

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixTriangularSolve`(https://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matrix_triangular_solve_op_impl.h#L160-L240) fails to terminate kernel execution if one validation condition fails. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.1.4 2.1.4 GHSA-vqw6-72r7-fgw7
PyPI tensorflow >= 2.2.0, < 2.2.3 2.2.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow >= 2.3.0, < 2.3.3 2.3.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow >= 2.4.0, < 2.4.2 2.4.2 GHSA-vqw6-72r7-fgw7
PyPI tensorflow < 2.2.0rc0 · >= 2.2.0, < 2.3.0rc0 · >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 PYSEC-2021-188
PyPI tensorflow-cpu < 2.1.4 2.1.4 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-cpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-cpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-cpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-cpu < 2.2.0rc0 · >= 2.2.0, < 2.3.0rc0 · >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 PYSEC-2021-479
PyPI tensorflow-gpu < 2.1.4 2.1.4 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-gpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-gpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-gpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-vqw6-72r7-fgw7
PyPI tensorflow-gpu < 2.2.0rc0 · >= 2.2.0, < 2.3.0rc0 · >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 PYSEC-2021-677

References