Skip to content
OpenAdvisories
High · 7.1 CVE-2021-37657 BIT-tensorflow-2021-37657EUVD-2021-0383GHSA-5xwc-mrhx-5g3mPYSEC-2021-279PYSEC-2021-570PYSEC-2021-768

Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlow

Published Aug 12, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. We have patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.3.4 2.3.4 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow >= 2.4.0, < 2.4.3 2.4.3 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow >= 2.5.0, < 2.5.1 2.5.1 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-279
PyPI tensorflow-cpu < 2.3.4 2.3.4 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-cpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-cpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-cpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-570
PyPI tensorflow-gpu < 2.3.4 2.3.4 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-gpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-gpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-5xwc-mrhx-5g3m
PyPI tensorflow-gpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-768

Advisories 1

References