CVE-2021-29520 - Heap buffer overflow in `Conv3DBackprop*`

Back Back to CVE browser

LOW

Heap buffer overflow in `Conv3DBackprop*`

Published May 14, 2021

2.0

LOW

CVSS 4.0

EPSS 0.22%

Description

TensorFlow is an end-to-end open source platform for machine learning. Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/4814fafb0ca6b5ab58a09411523b2193fed23fed/tensorflow/core/kernels/conv_grad_shape_utils.cc#L94-L153) assumes that the `input`, `filter_sizes` and `out_backprop` tensors have the same shape, as they are accessed in parallel. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected products

Vendor TensorFlow Product TensorFlow Default
n/a
- Version
  < 2.1.4
  Status
  affected
  Constraints
  -
- Version
  >= 2.2.0, < 2.2.3
  Status
  affected
  Constraints
  -
- Version
  >= 2.3.0, < 2.3.3
  Status
  affected
  Constraints
  -
- Version
  >= 2.4.0, < 2.4.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TensorFlow

n/a

Version	Status	Constraints
< 2.1.4	affected	-
>= 2.2.0, < 2.2.3	affected	-
>= 2.3.0, < 2.3.3	affected	-
>= 2.4.0, < 2.4.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-787

Out-of-bounds Write

References (7)

https://github.com/advisories/GHSA-wcv5-qrj6-9pfm
Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-448.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-646.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-157.yaml
https://github.com/tensorflow/tensorflow/commit/8f37b52e1320d8d72a9529b2468277791a261197
x_refsource_MISCPatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wcv5-qrj6-9pfm
x_refsource_CONFIRMExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29520

Link	Providers	Tags
https://github.com/advisories/GHSA-wcv5-qrj6-9pfm		Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-448.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-646.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-157.yaml
https://github.com/tensorflow/tensorflow/commit/8f37b52e1320d8d72a9529b2468277791a261197		x_refsource_MISCPatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wcv5-qrj6-9pfm		x_refsource_CONFIRMExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29520