CVE-2021-37670CWE-125

Heap OOB in `UpperBound` and `LowerBound` in TensorFlow

Medium · published August 12, 2021

CVSS v3.1
5.5
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.UpperBound`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/searchsorted_op.cc#L85-L104) does not validate the rank of `sorted_input` argument. A similar issue occurs in `tf.raw_ops.LowerBound`. We have patched the issue in GitHub commit 42459e4273c2e47a3232cc16c4f4fff3b3a35c38. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00169 · 5.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2021-08-12T22:25Z
EPSS history
Timeline
  • 12 AUG 22:25Z
    Heap OOB in `UpperBound` and `LowerBound` in TensorFlow
    cvelistv5