Skip to content
OpenAdvisories
Low · 2.5 CVE-2021-29615 BIT-tensorflow-2021-29615EUVD-2021-0356GHSA-qw5h-7f53-xrp6PYSEC-2021-252PYSEC-2021-543PYSEC-2021-741

Stack overflow in `ParseAttrValue` with nested tensors

Published May 14, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Vendor: TensorFlow Product: TensorFlow Package: tensorflow Package: tensorflow-cpu Package: tensorflow-gpu Ecosystem: PyPI

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.1.4 2.1.4 GHSA-qw5h-7f53-xrp6
PyPI tensorflow >= 2.2.0, < 2.2.3 2.2.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow >= 2.3.0, < 2.3.3 2.3.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow >= 2.4.0, < 2.4.2 2.4.2 GHSA-qw5h-7f53-xrp6
PyPI tensorflow < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-252
PyPI tensorflow-cpu < 2.1.4 2.1.4 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-cpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-cpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-cpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-cpu < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-543
PyPI tensorflow-gpu < 2.1.4 2.1.4 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-gpu >= 2.2.0, < 2.2.3 2.2.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-gpu >= 2.3.0, < 2.3.3 2.3.3 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-gpu >= 2.4.0, < 2.4.2 2.4.2 GHSA-qw5h-7f53-xrp6
PyPI tensorflow-gpu < 2.1.4 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.3 · >= 2.4.0, < 2.4.2 2.1.4, 2.2.3, 2.3.3, 2.4.2 PYSEC-2021-741

References