CVE-2021-29570 log
Source |
|
Severity | Low |
Remote | No |
Type | Information disclosure |
Description | A security issue has been found in TensorFlow before version 2.4.2. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ef0c008ee84bad91ec6725ddc42091e19a30cf0e/tensorflow/core/kernels/maxpooling_op.cc#L1016-L1017) uses the same value to index in two different arrays but there is no guarantee that the sizes are identical. |
Group | Package | Affected | Fixed | Severity | Status | Ticket |
---|---|---|---|---|---|---|
AVG-1962 | tensorflow | 2.4.1-10 | 2.5.0-1 | Critical | Fixed |
References |
---|
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-545v-42p7-98fq https://github.com/tensorflow/tensorflow/commit/dcd7867de0fea4b72a2b34bd41eb74548dc23886 |