CVE-2021-29569: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw…
- Occurred
- May 14, 2021
- Published
- May 14, 2021
- Source
- NVD CVE
Summary
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantization_range_op.cc#L49-L50) assumes that the `input_min` and `input_max` tensors have at least one element, as it accesses the first element in two arrays. If the tensors are empty, `.flat<T>()` is an empty object, backed by an empty array. Hence, accesing even the 0th element is a read outside the bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Tags
- CVE
- CVE-2021-29569
- cvss:LOW
Classification
Rationale: TensorFlow vulnerability in ML library causing potential memory corruption, classified under LLM due to ML framework context.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8