Stack overflow in `ParseAttrValue` with nested tensors

中 5.5CVE-2021-29615 · BIT-tensorflow-2021-29615 · GHSA-qw5h-7f53-xrp6 · 14/05/2021 公開 · 17/06/2026 更新

要点

CVE-2021-29615 は tensorflow, tensorflow-cpu, tensorflow-gpu に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.20%（全脆弱性の 10.4% より高い）。
対処：2.2.3, 2.3.3, 2.4.2, 2.1.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
tensorflow PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow-cpu PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow-gpu PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow google	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`

概要

Impact

The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input.

Patches

We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

NVD の説明

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.