TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
References
Link | Resource |
---|---|
https://github.com/tensorflow/tensorflow/commit/a7116dd3913c4a4afd2a3a938573aa7c785fdfc6 | Patch Third Party Advisory |
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc6c-75p4-hmq4 | Exploit Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Information
Published : 2021-05-14 13:15
Updated : 2021-05-20 09:28
NVD link : CVE-2021-29515
Mitre link : CVE-2021-29515
JSON object : View
CWE
CWE-476
NULL Pointer Dereference
Products Affected
- tensorflow