Home > Vulnerability Database > CVE-2021-29515

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2021-29515

Good to know:

Date: May 14, 2021

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Language: Python

Severity Score

2.5

Related Resources (8)

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-29515

Url: https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-152.yaml

Url: https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-443.yaml

Url: https://github.com/tensorflow/tensorflow/commit/a7116dd3913c4a4afd2a3a938573aa7c785fdfc6

Url: https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-641.yaml

Url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc6c-75p4-hmq4

Url: https://github.com/tensorflow/tensorflow

Url: https://www.mend.io/vulnerability-database/CVE-2021-29515

Severity Score

2.5

Weakness Type (CWE)

NULL Pointer Dereference

CWE-476

Top Fix

Upgrade Version

Upgrade to version tensorflow - 2.5.0

CVSS v3.1

Base Score:	2.5
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	LOW

CVSS v2

Base Score:	4.6
Access Vector (AV):	LOCAL
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us