CVE-2021-29603 - log back

CVE-2021-29603 edited at 14 May 2021 21:37:24
Severity
- Low
+ Medium
Type
- Unknown
+ Arbitrary code execution
CVE-2021-29603 edited at 14 May 2021 21:32:13
Severity
- Unknown
+ Low
Remote
- Unknown
+ Local
Description
+ A security issue has been found in TensorFlow before version 2.4.2. A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of `ArgMin`/`ArgMax`(https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/arg_min_max.cc#L52-L59). If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the condition in the `if` is never true, so code writes past the last valid element of `output_dims->data`.
References
+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-crch-j389-5f84
+ https://github.com/tensorflow/tensorflow/commit/c59c37e7b2d563967da813fa50fe20b21f4da683
CVE-2021-29603 created at 14 May 2021 20:37:16
Severity
+ Unknown
Remote
+ Unknown
Type
+ Unknown
Description
References
Notes