CVE-2021-37645CWE-681

Integer overflow due to conversion to unsigned in TensorFlow

Medium · published August 12, 2021

CVSS v3.1
5.5
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L126) uses the `axis` value as the size argument to `absl::InlinedVector` constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit 96f364a1ca3009f98980021c4b32be5fdcca33a1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, and TensorFlow 2.4.3, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-681 · Incorrect Conversion between Numeric Types
Published
2021-08-12T21:05Z
EPSS history
Timeline
  • 12 AUG 21:05Z
    Integer overflow due to conversion to unsigned in TensorFlow
    cvelistv5