CVE-2021-41217NULL Pointer Dereference in Tensorflow

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 5
Latest updateNov 10

Description

TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

NVDgoogle/tensorflow2.5.02.5.2+2
CVEListV5tensorflow/tensorflow< 2.4.4+2
PyPIintel/optimization_for_tensorflow2.6.02.6.1+4

Patches

🔴Vulnerability Details

4
GHSA
Null pointer exception when `Exit` node is not preceded by `Enter` op2021-11-10
OSV
Null pointer exception when `Exit` node is not preceded by `Enter` op2021-11-10
CVEList
Null pointer exception when `Exit` node is not preceded by `Enter` op2021-11-05
OSV
CVE-2021-41217: TensorFlow is an open source platform for machine learning2021-11-05

📋Vendor Advisories

1
Debian
CVE-2021-41217: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...2021
CVE-2021-41217 — NULL Pointer Dereference in Tensorflow | cvebase