CVE-2021-29592CWE-476

Null pointer dereference in TFLite's `Reshape` operator

Medium · published May 14, 2021

CVSS v3.1
4.4
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. The fix for CVE-2020-15209(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209) missed the case when the target shape of `Reshape` operator is given by the elements of a 1-D tensor. As such, the fix for the vulnerability(https://github.com/tensorflow/tensorflow/blob/9c1dc920d8ffb4893d6c9d27d1f039607b326743/tensorflow/lite/core/subgraph.cc#L1062-L1074) allowed passing a null-buffer-backed tensor with a 1D shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2021-05-14T19:22Z
EPSS history
Timeline
  • 14 MAY 19:22Z
    Null pointer dereference in TFLite's `Reshape` operator
    cvelistv5