CVE-2021-41224

Опубликовано: 05 нояб. 2021

Источник: nvd

CVSS3: 7.1

CVSS2: 3.6

EPSS Низкий

Описание

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SparseFillEmptyRows can be made to trigger a heap OOB access. This occurs whenever the size of indices does not match the size of values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Ссылки

https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rg3m-hqc5-344v
Exploit
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rg3m-hqc5-344v
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия до 2.4.4 (исключая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.5.0 (включая) до 2.5.2 (исключая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.1 (исключая)

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2021-41224

CVSS3: 7.1

debian

больше 4 лет назад

TensorFlow is an open source platform for machine learning. In affecte ...

GHSA-rg3m-hqc5-344v

CVSS3: 7.1

github

около 4 лет назад

`SparseFillEmptyRows` heap OOB

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125