AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Dashboard Vulnerabilities News Research Archive Stats Dataset For devs

aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

Vulnerabilities News Research Digest Archive Newsletter Archive Subscribe Data Sources Statistics Dataset API Integrations Widget RSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

CVE-2021-29571: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWith | AI Sec Watch

CVE-2021-29571: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWith

mediumvulnerability

security

Source: NVD/CVE DatabaseMay 14, 2021CVE-2021-29571

Summary

TensorFlow, an open-source machine learning platform, has a vulnerability in the `tf.raw_ops.MaxPoolGradWithArgmax` function where attackers can provide specially crafted input data to read and write outside the bounds of heap-allocated memory (memory areas assigned during program execution), potentially causing memory corruption. The issue occurs because the code assumes the last element of the `boxes` input is 4 without checking it first, so attackers can pass smaller values to access memory they shouldn't.

Solution / Mitigation

The fix will be included in TensorFlow 2.5.0 and will also be backported (copied to earlier versions still being supported) in TensorFlow 2.4.2, 2.3.3, 2.2.3, and 2.1.4.