CVE-2021-37648

一、漏洞信息
 漏洞编号：[CVE-2021-37648](https://nvd.nist.gov/vuln/detail/CVE-2021-37648)
 漏洞归属组件：tensorflow
 漏洞归属的版本：2.3.1
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the code for `tf.raw_ops.SaveV2` does not properly validate the inputs and an attacker can trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/save_restore_v2_ops.cc) uses `ValidateInputs` to check that the input arguments are valid. This validation would have caught the illegal state represented by the reproducer above. However, the validation uses `OP_REQUIRES` which translates to setting the `Status` object of the current `OpKernelContext` to an error status, followed by an empty `return` statement which just terminates the execution of the function it is present in. However, this does not mean that the kernel execution is finalized: instead, execution continues from the next line in `Compute` that follows the call to `ValidateInputs`. This is equivalent to lacking the validation. We have patched the issue in GitHub commit 9728c60e136912a12d99ca56e106b7cce7af5986. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
 漏洞公开时间：2021-08-13 06:15
 漏洞创建时间：2021-08-19 09:11:37
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-37648
 漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md
二、漏洞分析结构反馈
 影响性分析说明：
  TensorFlow 是一个端到端的机器学习开源平台。在受影响的版本中，`tf.raw_ops.SaveV2` 的代码没有正确验证输入，攻击者可以触发空指针取消引用。[实现]（https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/save_restore_v2_ops.cc）使用`验证输入参数`来检查。此验证将捕获由上述复制器表示的非法状态。然而，验证使用“OP_REQUIRES”，它将当前“OpKernelContext”的“Status”对象设置为错误状态，然后是一个空的“return”语句，它只是终止它所在函数的执行。然而，这并不意味着内核执行完成:相反，从调用 ValidateInputs 之后的 Compute 中的下一行继续执行。这相当于缺少验证。我们已在 GitHub 提交 9728c60e136912a12d99ca56e106b7cce7af5986 中修补了该问题。该修复程序将包含在 TensorFlow 2.6.0 中。我们还将在 TensorFlow 2.5.1、TensorFlow 2.4.3 和 TensorFlow 2.3.4 上挑选此提交，因为它们也受到影响并且仍在支持范围内。
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.3.1):受影响
2.openEuler-21.03(2.3.1):受影响
3.openEuler-21.09(2.3.1):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.3.1):否
2.openEuler-21.03(2.3.1):否
3.openEuler-21.09(2.3.1):否

src-openEuler/tensorflow

内容风险标识

评论 (5)

src-openEuler/tensorflow .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-37648

评论 (5)

搜索帮助

src-openEuler/tensorflow