Skip to content
LLMMedium

CVE-2021-29603: TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite mo…

Occurred
May 14, 2021
Published
May 14, 2021
Source
NVD CVE

Summary

TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of `ArgMin`/`ArgMax`(https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/arg_min_max.cc#L52-L59). If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the condition in the `if` is never true, so code writes past the last valid element of `output_dims->data`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Tags

  • CVE
  • CVE-2021-29603
  • cvss:LOW

Classification

Category confidence: 90%
Severity confidence: 85%

Rationale: CVE describes a memory corruption vulnerability in TensorFlow's TFLite implementation affecting ML model execution.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source