AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Dashboard Vulnerabilities News Research Archive Stats Dataset For devs

aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

Vulnerabilities News Research Digest Archive Newsletter Archive Subscribe Data Sources Statistics Dataset API Integrations Widget RSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

CVE-2021-37671: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefi | AI Sec Watch

CVE-2021-37671: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefi

highvulnerability

security

Source: NVD/CVE DatabaseAugust 12, 2021CVE-2021-37671

Summary

TensorFlow, an open source machine learning platform, has a vulnerability in its Map and OrderedMap operations where an attacker can cause undefined behavior (unpredictable or dangerous program actions) by exploiting a missing check for empty data indices. The code checks if indices are in order but doesn't verify they exist, leaving a gap that can lead to null pointer reference binding (attempting to use memory that hasn't been allocated).

Solution / Mitigation

The fix is included in TensorFlow 2.6.0 and was cherrypicked into TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4. Users of affected versions should update to one of these patched releases.