TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/svdf.cc#L300-L313). The [`GetVariableInput` function](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L115-L119) can return a null pointer but `GetTensorData` assumes that the argument is always a valid tensor. Furthermore, because `GetVariableInput` calls [`GetMutableInput`](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L82-L90) which might return `nullptr`, the `tensor->is_variable` expression can also trigger a null pointer exception. We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Find out more about CVE-2021-37681 from the MITRE-CVE dictionary and NIST NVD
Login may be required to access defects or downloads.
| Product Name | Status | Defect | Fixed | Downloads |
|---|---|---|---|---|
| Linux | ||||
| Wind River Linux LTS 17 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux 8 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux 9 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux 7 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux LTS 21 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux LTS 22 | Not Vulnerable | -- | -- | -- |
| Wind River Linux LTS 18 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux LTS 19 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux CD release | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Wind River Linux 6 | Not Vulnerable | -- | -- | -- |
| Wind River Linux LTS 23 | Not Vulnerable | -- | -- | -- |
| VxWorks | ||||
| VxWorks 7 | Fixed | -- | 21.11 |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| VxWorks 6.9 | Not Vulnerable | -- | -- |
Wind River VxWorks 20211027 Security Alert for TensorFlow Lite |
| Helix Virtualization Platform Cert Edition | ||||
| Helix Virtualization Platform Cert Edition | Not Vulnerable | -- | -- | -- |
| Product Name | Status | Defect | Fixed | Downloads |
|---|
