Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-29575

Опубликовано: 14 мая 2021
Источник: nvd
CVSS3: 2.5
CVSS3: 5.5
CVSS2: 2.1
EPSS Низкий

Описание

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.raw_ops.ReverseSequence allows for stack overflow and/or CHECK-fail based denial of service. The implementation(https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that seq_dim and batch_dim arguments are valid. Negative values for seq_dim can result in stack overflow or CHECK-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of batch_dim. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Версия до 2.1.4 (включая)
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Версия от 2.2.0 (включая) до 2.2.3 (исключая)
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Версия от 2.3.0 (включая) до 2.3.3 (исключая)
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Версия от 2.4.0 (включая) до 2.4.2 (исключая)

EPSS

Процентиль: 3%
0.00017
Низкий

2.5 Low

CVSS3

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-119
CWE-787

Связанные уязвимости

CVSS3: 2.5
debian
больше 4 лет назад

TensorFlow is an end-to-end open source platform for machine learning. ...

CVSS3: 2.5
github
больше 4 лет назад

Overflow/denial of service in `tf.raw_ops.ReverseSequence`

EPSS

Процентиль: 3%
0.00017
Низкий

2.5 Low

CVSS3

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-119
CWE-787