{"data":{"id":"3e5edead-60a6-43a0-81dc-6d17a56234ce","title":"CVE-2021-29571: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWith","summary":"TensorFlow, an open-source machine learning platform, has a vulnerability in the `tf.raw_ops.MaxPoolGradWithArgmax` function where attackers can provide specially crafted input data to read and write outside the bounds of heap-allocated memory (memory areas assigned during program execution), potentially causing memory corruption. The issue occurs because the code assumes the last element of the `boxes` input is 4 without checking it first, so attackers can pass smaller values to access memory they shouldn't.","solution":"The fix will be included in TensorFlow 2.5.0 and will also be backported (copied to earlier versions still being supported) in TensorFlow 2.4.2, 2.3.3, 2.2.3, and 2.1.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-29571","publishedAt":"2021-05-15T00:15:13.877Z","cveId":"CVE-2021-29571","cweIds":["CWE-787"],"cvssScore":"4.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00026,"patchAvailable":null,"disclosureDate":null,"capecIds":["CAPEC-100"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}