CVE-2021-37670 — Vulnetix

CVE-2021-37670 PUBLISHED

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.UpperBound`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/searchsorted_op.cc#L85-L104) does not validate the rank of `sorted_input` argument. A similar issue occurs in `tf.raw_ops.LowerBound`. We have patched the issue in GitHub commit 42459e4273c2e47a3232cc16c4f4fff3b3a35c38. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS 0.05% · 16.9th percentile

Risk Scores

EPSS Score

0.05%

16.9th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0

Timeline

Aug 12, 2021 CVE Published
Aug 13, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 3, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score
Jul 28, 2022 EPSS Score
Sep 24, 2022 EPSS Score
Nov 21, 2022 EPSS Score
Jan 18, 2023 EPSS Score

References

Open in Interactive Console →