CVE-2021-29575
Overflow/denial of service in `tf.raw_ops.ReverseSequence`
Description
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service. The implementation(https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that `seq_dim` and `batch_dim` arguments are valid. Negative values for `seq_dim` can result in stack overflow or `CHECK`-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of `batch_dim`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
How to fix CVE-2021-29575
To remediate CVE-2021-29575, upgrade the affected package to a fixed version below.
- —upgrade to 2.1.5 or later
- —upgrade to 2.1.4 or later
- —upgrade to ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 or later
- —upgrade to ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 or later
- —upgrade to 2.1.4 or later
- —upgrade to ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 or later
- —upgrade to 2.1.4 or later
Is CVE-2021-29575 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (7)
- from 0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2
- from 0, < 2.1.4
- from 0, < ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 | from 0, < 2.2.0rc0, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2
- from 0, < ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 | from 0, < 2.2.0rc0, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2
- from 0, < 2.1.4
- from 0, < ecf768cbe50cedc0a45ce1ee223146a3d3d26d23 | from 0, < 2.2.0rc0, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2
- from 0, < 2.1.4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | LOW2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |