CVE-2021-37692 — Improper Input Validation in Google

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	>= 2.5.0 < 2.6.0	2.6.0
intel	optimization_for_tensorflow	>= 0 < 8721ba96e5760c229217b594f6d2ba332beedf22	8721ba96e5760c229217b594f6d2ba332beedf22
intel	optimization_for_tensorflow	>= 2.3.0 < 2.3.4	2.3.4
intel	optimization_for_tensorflow	>= 2.4.0 < 2.4.3	2.4.3
intel	optimization_for_tensorflow	>= 2.5.0rc0 < 2.5.1	2.5.1
tensorflow	tensorflow	—	—

GHSA

Segfault on strings tensors with mistmatched dimensions, due to Go code

ghsa·2021-08-25

CVE-2021-37692 [MEDIUM] CWE-20 Segfault on strings tensors with mistmatched dimensions, due to Go code Segfault on strings tensors with mistmatched dimensions, due to Go code ### Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. ### Patches We have patched the issue in GitHub commit [8721ba96e5760c229

OSV

Segfault on strings tensors with mistmatched dimensions, due to Go code

osv·2021-08-25

CVE-2021-37692 [MEDIUM] Segfault on strings tensors with mistmatched dimensions, due to Go code Segfault on strings tensors with mistmatched dimensions, due to Go code ### Impact Under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. ### Patches We have patched the issue in GitHub commit [8721ba96e5760c229

OSV

CVE-2021-37692: TensorFlow is an end-to-end open source platform for machine learning

osv·2021-08-12

CVE-2021-37692 CVE-2021-37692: TensorFlow is an end-to-end open source platform for machine learning TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6

Debian

CVE-2021-37692: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect...

vendor_debian·2021·CVSS 5.5

CVE-2021-37692 [MEDIUM] CVE-2021-37692: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect... TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6

CVE-2021-37692: TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string…

Affected

CVSS provenance