CVE-2021-29544

一、漏洞信息
 漏洞编号：[CVE-2021-29544](https://nvd.nist.gov/vuln/detail/CVE-2021-29544)
 漏洞归属组件：tensorflow
 漏洞归属的版本：2.3.1
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L162-L163) does not validate the rank of the `input_*` tensors. In turn, this results in the tensors being passes as they are to `QuantizeAndDequantizePerChannelGradientImpl`(https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.h#L295-L306). However, the `vec<T>` method, requires the rank to 1 and triggers a `CHECK` failure otherwise. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.
 漏洞公开时间：2021-05-14
 漏洞创建时间：2021-05-21 11:44:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-29544
 漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md
二、漏洞分析结构反馈
 影响性分析说明：
  TensorFlow 是一个端到端的机器学习开源平台。攻击者可以通过 `tf.raw_ops.QuantizeAndDequantizeV4Grad` 中的 `CHECK`-fail 触发拒绝服务。这是因为实现（https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L162-L163. 反过来，这会导致张量按原样传递给 `QuantizeAndDequantizePerChannelGradientImpl`（https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/quantize_kerand.0L3/quantize_2L3_6Lh/quantize_kernelsh/。但是，`vec<T>` 方法要求等级为 1，否则会触发 `CHECK` 失败。该修复将包含在 TensorFlow 2.5.0 中。
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.3.1):受影响
2.openEuler-21.03(2.3.1):受影响
3.openEuler-21.09(2.3.1):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.3.1):否
2.openEuler-21.03(2.3.1):否
3.openEuler-21.09(2.3.1):否

src-openEuler/tensorflow

内容风险标识

评论 (5)

src-openEuler/tensorflow .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-29544

评论 (5)

搜索帮助

src-openEuler/tensorflow