Skip to content
OpenAdvisories
Low · 2.5 CVE-2021-29577 BIT-tensorflow-2021-29577EUVD-2021-0318GHSA-v6r6-84gr-92rmPYSEC-2021-214PYSEC-2021-505PYSEC-2021-703

Heap buffer overflow in `AvgPool3DGrad`

Published May 14, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.AvgPool3DGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/d80ffba9702dc19d1fac74fc4b766b3fa1ee976b/tensorflow/core/kernels/pooling_ops_3d.cc#L376-L450) assumes that the `orig_input_shape` and `grad` tensors have similar first and last dimensions but does not check that this assumption is validated. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.1.4 2.1.4 GHSA-v6r6-84gr-92rm
PyPI tensorflow >= 2.2.0, < 2.2.3 2.2.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow >= 2.3.0, < 2.3.3 2.3.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow >= 2.4.0, < 2.4.2 2.4.2 GHSA-v6r6-84gr-92rm
PyPI tensorflow < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-214
PyPI tensorflow-cpu < 2.1.4 2.1.4 GHSA-v6r6-84gr-92rm
PyPI tensorflow-cpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow-cpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow-cpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-v6r6-84gr-92rm
PyPI tensorflow-cpu < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-505
PyPI tensorflow-gpu < 2.1.4 2.1.4 GHSA-v6r6-84gr-92rm
PyPI tensorflow-gpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow-gpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-v6r6-84gr-92rm
PyPI tensorflow-gpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-v6r6-84gr-92rm
PyPI tensorflow-gpu < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-703

References