Skip to content
OpenAdvisories
High · 7.1 CVE-2021-37658 BIT-tensorflow-2021-37658EUVD-2021-0384GHSA-6p5r-g9mq-ggh2PYSEC-2021-280PYSEC-2021-571PYSEC-2021-769

Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlow

Published Aug 12, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. We have patched the issue in GitHub commit ff8894044dfae5568ecbf2ed514c1a37dc394f1b. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.3.4 2.3.4 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow >= 2.4.0, < 2.4.3 2.4.3 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow >= 2.5.0, < 2.5.1 2.5.1 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-280
PyPI tensorflow-cpu < 2.3.4 2.3.4 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-cpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-cpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-cpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-571
PyPI tensorflow-gpu < 2.3.4 2.3.4 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-gpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-gpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-6p5r-g9mq-ggh2
PyPI tensorflow-gpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-769

Advisories 1

References