CVE-2021-41199 — Integer Overflow or Wraparound in Tensorflow

CWE-190 — Integer Overflow or Wraparound6 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 84.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TensorflowGoogle TensorflowIntel Optimization FOR Tensorflow
Timeline
PublishedNov 5
Latest updateNov 10

Description

TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDgoogle/tensorflow2.5.0 — 2.5.2+2
▶CVEListV5tensorflow/tensorflow< 2.4.4+2
▶PyPIintel/optimization_for_tensorflow2.6.0 — 2.6.1+4

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Overflow/crash in `tf.image.resize` when size is large↗2021-11-10
▶
OSV
Overflow/crash in `tf.image.resize` when size is large↗2021-11-10
▶
OSV
CVE-2021-41199: TensorFlow is an open source platform for machine learning↗2021-11-05
▶
CVEList
Overflow/crash in `tf.image.resize` when size is large↗2021-11-05
▶

📋Vendor Advisories

1
Debian
CVE-2021-41199: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...↗2021
▶
CVE-2021-41199 — Integer Overflow or Wraparound | cvebase