CVE-2021-37639

一、漏洞信息
 漏洞编号：[CVE-2021-37639](https://nvd.nist.gov/vuln/detail/CVE-2021-37639)
 漏洞归属组件：tensorflow
 漏洞归属的版本：2.3.1
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer. Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159) retrieves the tensor list corresponding to the `tensor_name` user controlled input and immediately retrieves the tensor at the restoration index (controlled via `preferred_shard` argument). This occurs without validating that the provided list has enough values. If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read. We have patched the issue in GitHub commit 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
 漏洞公开时间：2021-08-13 03:15
 漏洞创建时间：2021-08-19 03:12:53
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-37639
 漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md
二、漏洞分析结构反馈
 影响性分析说明：
  TensorFlow 是一个端到端的机器学习开源平台。通过原始 API 恢复张量时，如果未提供张量名称，则 TensorFlow 可能会被诱骗取消引用空指针。或者，攻击者可以通过提供一些张量名称来读取堆分配数据范围之外的内存，但不足以成功恢复。[实现](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159 立即检索到用户输入的tensor 控制列表和对应的tensor 列表在恢复索引处检索张量（通过“preferred_shard”参数控制）。发生这种情况时并未验证提供的列表是否具有足够的值。如果列表为空，这将导致取消引用空指针（未定义行为）。但是，如果列表有一些元素，如果恢复索引超出范围，这将导致堆 OOB 读取。我们已在 GitHub 提交 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622 中修补了该问题。该修复程序将包含在 TensorFlow 2.6.0 中。我们还将在 TensorFlow 2.5.1、TensorFlow 2.4.3 和 TensorFlow 2.3.4 上挑选此提交，因为它们也受到影响并且仍在支持范围内。
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.3.1):受影响
2.openEuler-21.03(2.3.1):受影响
3.openEuler-21.09(2.3.1):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.3.1):否
2.openEuler-21.03(2.3.1):否
3.openEuler-21.09(2.3.1):否

src-openEuler/tensorflow
关闭

内容风险标识

评论 (4)

src-openEuler/tensorflow关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-37639

评论 (4)

搜索帮助

src-openEuler/tensorflow
关闭