CVE-2021-29617CWE-755

Crash in `tf.strings.substr` due to `CHECK`-fail

Low · published May 14, 2021

CVSS v3.1
2.5
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2021-05-14T19:25Z
EPSS history
Timeline
  • 14 MAY 19:25Z
    Crash in `tf.strings.substr` due to `CHECK`-fail
    cvelistv5