CVE-2021-29583

一、漏洞信息
 漏洞编号：[CVE-2021-29583](https://nvd.nist.gov/vuln/detail/CVE-2021-29583)
 漏洞归属组件：TensorFlow
 漏洞归属的版本：2.3.1,1.15.2
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation(https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc) fails to validate that `scale`, `offset`, `mean` and `variance` (the last two only when required) all have the same number of elements as the number of channels of `x`. This results in heap out of bounds reads when the buffers backing these tensors are indexed past their boundary. If the tensors are empty, the validation mentioned in the above paragraph would also trigger and prevent the undefined behavior. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
 漏洞公开时间：2021-05-14
 漏洞创建时间：2021-08-27 12:22:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-29583
 漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md
二、漏洞分析结构反馈
 影响性分析说明：
  TensorFlow 是一个端到端的机器学习开源平台。`tf.raw_ops.FusedBatchNorm` 的实现容易受到堆缓冲区溢出的影响。如果张量为空，则相同的实现可以通过取消引用空指针来触发未定义的行为。实现（https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc）未能验证`scale`、`offset`、`mean`和`variance最后两个仅在需要时）都具有与 `x` 的通道数相同的元素数。当支持这些张量的缓冲区被索引超过它们的边界时，这会导致堆越界读取。如果张量为空，上一段中提到的验证也会触发并防止未定义的行为。该修复将包含在 TensorFlow 2.5.0 中。我们还将在 TensorFlow 2.4.2、TensorFlow 2.3.3、TensorFlow 2.2.3 和 TensorFlow 2.1.4 上挑选此提交，因为它们也受到影响并且仍在支持范围内。
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.3.1):受影响
2.openEuler-21.03(2.3.1):受影响
3.openEuler-21.09(2.3.1):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.3.1):否
2.openEuler-21.03(2.3.1):否
3.openEuler-21.09(2.3.1):否

src-openEuler/tensorflow
关闭

内容风险标识

评论 (6)

src-openEuler/tensorflow关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-29583

评论 (6)

搜索帮助

src-openEuler/tensorflow
关闭