CVE-2021-41201CWE-824

Unitialized access in `EinsumHelper::ParseEquation`

High · published November 5, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to `true` and never assigns `false`. This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2021-11-05T20:05Z
EPSS history
Timeline
  • 05 NOV 20:05Z
    Unitialized access in `EinsumHelper::ParseEquation`
    cvelistv5