Advisoriesby IbisTensorFlowGHSA-wvjw-p9f5-vq28
Segfault in `tf.raw_ops.SparseCountSparseOutput`
Fix: upgrade to 2.1.4 or later (4 fixed versions below)
Impact
Passing invalid arguments (e.g., discovered via fuzzing) to tf.raw_ops.SparseCountSparseOutput results in segfault.
Patches
We have patched the issue in GitHub commit [82e6203221865de4008445b13c69b6826d2b28d9](https://github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9).
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.1.4 | 2.1.4 |
| >= 2.2.0, < 2.2.3 | 2.2.3 | |
| >= 2.3.0, < 2.3.3 | 2.3.3 | |
| >= 2.4.0, < 2.4.2 | 2.4.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-755
- Also known as
- BIT-tensorflow-2021-29619, CVE-2021-29619, PYSEC-2021-256, PYSEC-2021-547, PYSEC-2021-745
- github.com/tensorflow/tensorflow/security/advisories/GHSA-wvjw-p9f5-vq28
- nvd.nist.gov/vuln/detail/CVE-2021-29619
- github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-547.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-745.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-256.yaml
- github.com/tensorflow/tensorflow
More TensorFlow advisories
All TensorFlow
Crash in `tf.transpose` with complex inputsCVE-2021-29618fixed in 2.1.4 +3Crash in `tf.strings.substr` due to `CHECK`-failCVE-2021-29617fixed in 2.1.4 +3Null dereference in Grappler's `TrySimplify`CVE-2021-29616fixed in 2.1.4 +3Stack overflow in `ParseAttrValue` with nested tensorsCVE-2021-29615fixed in 2.1.4 +3Interpreter crash from `tf.io.decode_raw`CVE-2021-29614fixed in 2.1.4 +3Incomplete validation in `tf.raw_ops.CTCLoss`CVE-2021-29613fixed in 2.1.4 +3