CVE-2021-41201 Information

Description

TensorFlow is an open source platform for machine learning. In affeced versions during execution EinsumHelper::ParseEquation() is supposed to set the flags in input_has_ellipsis vector and output_has_ellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output. However the code only changes these flags to true and never assigns false. This results in unitialized variable access if callers assume that EinsumHelper::ParseEquation() always sets these flags. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j86v-p27c-73fm

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8