CVE-2021-29512
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-29512
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29512.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-29512
- Aliases
- Related
- Published
- 2021-05-14T19:15:07Z
- Modified
- 2025-09-19T13:07:53.445999Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
TensorFlow is an end-to-end open source platform for machine learning. If the
splitsargument ofRaggedBincountdoes not specify a validSparseTensor(https://www.tensorflow.org/apidocs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of thesplitstensor buffer in the implementation of theRaggedBincountop(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincountop.cc#L430-L433). Before theforloop,batch_idxis set to 0. The user controls thesplitsarray, making it contain only one element, 0. Thus, the code in thewhileloop would incrementbatch_idxand then try to readsplits(1), which is outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected. - References
Affected packages
Git / github.com/tensorflow/tensorflow
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tensorflow/tensorflow
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
v0.*
v1.*
Database specific
{
"vanir_signatures": [
{
"id": "CVE-2021-29512-e78c135e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50071248545797929442961525939004416823",
"313533363499102381398855757400300590347",
"34732738541755971658578122202906975538"
]
},
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "tensorflow/core/kernels/bincount_op.cc"
},
"signature_type": "Line",
"source": "https://github.com/tensorflow/tensorflow/commit/eebb96c2830d48597d055d247c0e9aebaea94cd5"
}
]
}