Security Bulletin: Multiple TensorFlow Vulnerabilities Affect IBM Watson Machine Learning on CP4D

Vulnerability Details

CVEID:   CVE-2021-29538
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by division by zero in `Conv2DBackpropFilter`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202073 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29512
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap-based buffer overflow in `RaggedBinCount`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202091 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29516
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a NULL pointer dereference in `tf.raw_ops.RaggedTensorToVariant`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202087 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29530
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by invalid validation in `SparseMatrixSparseCholesky`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202081 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29534
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a `CHECK`-fail in `SparseConcat`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202077 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29531
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a `CHECK`-fail in `tf.raw_ops.EncodePng`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202080 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29535
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap-based buffer overflow in `QuantizedMul`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202076 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29513
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap out-of-bounds write in `RaggedBinCount`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202090 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29517
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by division by zero in `Conv3D`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202086 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29514
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap out-of-bounds write in `RaggedBinCount`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202089 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29518
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a NULL pointer dereferences in session operations in eager mode. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202084 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29532
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap out of bounds read in `RaggedCross`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202079 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29536
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap-based buffer overflow in `QuantizedReshape `. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202075 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29533
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a `CHECK`-fail in `DrawBoundingBoxes`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202078 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29537
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap-based buffer overflow in `QuantizedResizeBilinear`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202074 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29515
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a NULL pointer dereference in `MatrixDiag*`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202088 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-29529
DESCRIPTION:   TensorFlow is vulnerable to a denial of service, caused by a heap-based buffer overflow in `tf.raw_ops.QuantizedResizeBilinear`. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202082 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)