Stack overflow in `ParseAttrValue` with nested tensors

TRUNG BÌNH 5.5CVE-2021-29615 · BIT-tensorflow-2021-29615 · GHSA-qw5h-7f53-xrp6 · Công bố 14/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-29615 là lỗ hổng mức TRUNG BÌNH (CVSS 5.5) ảnh hưởng tensorflow, tensorflow-cpu, tensorflow-gpu.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.20%, cao hơn 10.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.2.3, 2.3.3, 2.4.2, 2.1.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tensorflow PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow-cpu PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow-gpu PyPI	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`
tensorflow google	`≥ 2.2.0, < 2.2.3≥ 2.3.0, < 2.3.3≥ 2.4.0, < 2.4.2< 2.1.4`	`2.2.32.3.32.4.22.1.4`

Mô tả

Impact

The implementation of ParseAttrValue can be tricked into stack overflow due to recursion by giving in a specially crafted input.

Patches

We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1.

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Mô tả của NVD

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.