CVE-2021-37688 — Vulnetix

CVE-2021-37688 PUBLISHED

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a pointer. We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS 0.05% · 14.7th percentile

Risk Scores

EPSS Score

0.05%

14.7th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0

Timeline

Aug 12, 2021 CVE Published
Aug 13, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 3, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score
Jul 28, 2022 EPSS Score
Sep 24, 2022 EPSS Score
Nov 21, 2022 EPSS Score
Jan 18, 2023 EPSS Score

References

Open in Interactive Console →