Vulnerability · Published May 14, 2021 · Assigned by GitHub_M

CVE-2021-29544CHECK-fail in `QuantizeAndDequantizeV4Grad`

Low 2.5

In plain English

A low-severity security flaw in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`. This is because the implementation does not validate the rank of the `input_*` tensors. In turn, this results in the tensors being passes as they are to `QuantizeAndDequantizePerChannelGradientImpl`. However, the `vec<T>` method, requires the rank to 1 and triggers a `CHECK` failure otherwise. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	tensorflow	2.4.2	GHSA-6g85-3hm8-83f9
PyPI	tensorflow	2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3	PYSEC-2021-181
PyPI	tensorflow-cpu	2.4.2	GHSA-6g85-3hm8-83f9
PyPI	tensorflow-cpu	2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3	PYSEC-2021-472
PyPI	tensorflow-gpu	2.4.2	GHSA-6g85-3hm8-83f9
PyPI	tensorflow-gpu	2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3	PYSEC-2021-670

Affected products (as reported)

Vendor	Product	Versions
tensorflow	tensorflow	>= 2.4.0, < 2.4.2

Weakness: CWE-754 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References