CVE-2021-37665 log

Severity Medium
Remote No
Type Insufficient validation
In TensorFlow before version 2.6.0 due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays. The implementation does not validate the dimensions of the input tensor. A similar issue occurs in MklRequantizePerChannelOp. The implementation does not perform full validation for all the input arguments and in the Github commit 203214568f5bc237603dbab6e1fd389f1572f5c9.
Group Package Affected Fixed Severity Status Ticket
AVG-2292 tensorflow 2.5.0-6 2.5.1-1 Critical Fixed