CVE-2021-37679
published 2021-08-12CVE-2021-37679: TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn`…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.0th percentile
TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a `Variant` tensor to a `RaggedTensor`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190) does not check that all inner shapes match and this results in the additional dimensions. The same implementation can result in data loss, if input tensor is tweaked. We have patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | — | — | |
| tensorflow | — | — | |
| tensorflow | >= 2.3.0 < 2.3.4 | 2.3.4 | |
| tensorflow | >= 2.4.0 < 2.4.3 | 2.4.3 | |
| intel | optimization_for_tensorflow | >= 0 < 4e2565483d0ffcadc719bd44893fb7f609bb5f12 | 4e2565483d0ffcadc719bd44893fb7f609bb5f12 |
| intel | optimization_for_tensorflow | >= 0 < 2.3.4 | 2.3.4 |
| intel | optimization_for_tensorflow | >= 2.3.0 < 2.3.4 | 2.3.4 |
| intel | optimization_for_tensorflow | >= 2.4.0 < 2.4.3 | 2.4.3 |
| intel | optimization_for_tensorflow | >= 2.5.0 < 2.5.1 | 2.5.1 |
| tensorflow | tensorflow | < 2.3.4 | 2.3.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
osv·2021-08-25
CVE-2021-37679 [HIGH] Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
### Impact
It is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:
```python
import tensorflow as tf
x = tf.ragged.constant([[1,2,3], [4,5], [6]])
t = tf.map_fn(lambda r: tf.map_fn(lambda y: r, r), x)
z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]])
```
The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information.
The bug lies in the conversion from a `Variant` tensor to a `Ragg
GHSA
Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
ghsa·2021-08-25
CVE-2021-37679 [HIGH] CWE-125 Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
### Impact
It is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:
```python
import tensorflow as tf
x = tf.ragged.constant([[1,2,3], [4,5], [6]])
t = tf.map_fn(lambda r: tf.map_fn(lambda y: r, r), x)
z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]])
```
The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information.
The bug lies in the conversion from a `Variant` tensor to a `Ragg
OSV
CVE-2021-37679: TensorFlow is an end-to-end open source platform for machine learning
osv·2021-08-12
CVE-2021-37679 CVE-2021-37679: TensorFlow is an end-to-end open source platform for machine learning
TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a `Variant` tensor to a `RaggedTensor`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190
Debian
CVE-2021-37679: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect...
vendor_debian·2021·CVSS 7.1
CVE-2021-37679 [HIGH] CVE-2021-37679: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect...
TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a `Variant` tensor to a `RaggedTensor`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/commit/4e2565483d0ffcadc719bd44893fb7f609bb5f12https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g8wg-cjwc-xhhphttps://github.com/tensorflow/tensorflow/commit/4e2565483d0ffcadc719bd44893fb7f609bb5f12https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g8wg-cjwc-xhhp
2021-08-12
Published