CVE-2021-29590CWE-125

Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`

Low · published May 14, 2021

CVSS v3.1
2.5
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty. This is because the broadcasting implementation(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/maximum_minimum.h#L52-L56) indexes in both tensors with the same index but does not validate that the index is within bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2021-05-14T19:22Z
EPSS history
Timeline
  • 14 MAY 19:22Z
    Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`
    cvelistv5