CVE-2021-29601
Assigner: GitHub_M
Published: 2021-05-14T19:21:29
State: PUBLISHED
affected: product: tensorflow
vendor: tensorflow
versions: status: affected
version: < 2.1.4
status: affected
version: >= 2.2.0, < 2.2.3
status: affected
version: >= 2.3.0, < 2.3.3
status: affected
version: >= 2.4.0, < 2.4.2
descriptions: value: TensorFlow is an end-to-end open source platform for machine learning. The TFLite implementation of concatenation is vulnerable to an integer overflow issue(https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite/kernels/concatenation.cc#L70-L76). An attacker can craft a model such that the dimensions of one of the concatenation input overflow the values of `int`. TFLite uses `int` to represent tensor dimensions, whereas TF uses `int64`. Hence, valid TF models can trigger an integer overflow when converted to TFLite format. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-190
description: CWE-190: Integer Overflow or Wraparound
type: CWE
source: advisory: GHSA-9c84-4hx6-xmm4
discovery: UNKNOWN
title: Integer overflow in TFLite concatentation