正文

google tensorflow 对未经初始化资源的使用

admin
admin V管理员 /0 评论 /21 阅读
0421
此篇文章发布距今已超过1154天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2021-37682

利用情况

暂无

补丁情况

N/A

披露时间

2021-08-13
漏洞描述
TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200). The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different that `kTfLiteNoQuantization`. However, these checks are missing in large parts of the code. We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41b...
https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871...
https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263bab...
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxw
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 google tensorflow * From
(including)
2.3.0 		Up to
(excluding)
2.3.4
运行在以下环境
应用 google tensorflow * From
(including)
2.4.0 		Up to
(excluding)
2.4.3
运行在以下环境
应用 google tensorflow 2.5.0 -
运行在以下环境
应用 google tensorflow 2.6.0 -
CVSS3评分 7.1
  • 攻击路径 本地
  • 攻击复杂度 低
  • 权限要求 低
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 高
  • 保密性 无
  • 完整性 高
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CWE-ID 漏洞类型 CWE-908 对未经初始化资源的使用