VYPR
Low severityNVD Advisory· Published May 14, 2021· Updated Aug 3, 2024

OOB read in `MatrixTriangularSolve`

CVE-2021-29551

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixTriangularSolve(https://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matrix_triangular_solve_op_impl.h#L160-L240) fails to terminate kernel execution if one validation condition fails. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.1.42.1.4
tensorflowPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflowPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflowPyPI
>= 2.4.0, < 2.4.22.4.2
tensorflow-cpuPyPI
< 2.1.42.1.4
tensorflow-cpuPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflow-cpuPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflow-cpuPyPI
>= 2.4.0, < 2.4.22.4.2
tensorflow-gpuPyPI
< 2.1.42.1.4
tensorflow-gpuPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflow-gpuPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflow-gpuPyPI
>= 2.4.0, < 2.4.22.4.2

Affected products

1

Patches

1
480641e35997

Validate (and ensure validation sticks) inputs for `MatrixTriangularSolve`.

https://github.com/tensorflow/tensorflowMihai MaruseacApr 24, 2021via ghsa
1 file changed · +16 4
  • tensorflow/core/kernels/linalg/matrix_triangular_solve_op_impl.h+16 4 modified
    @@ -162,6 +162,9 @@ class BaseMatrixTriangularSolveOp : public OpKernel {
         const Tensor& in1 = ctx->input(1);
     
         ValidateInputTensors(ctx, in0, in1);
    +    if (!ctx->status().ok()) {
    +      return;
    +    }
     
         MatMulBCast bcast(in0.shape().dim_sizes(), in1.shape().dim_sizes());
         OP_REQUIRES(
    @@ -230,13 +233,22 @@ class MatrixTriangularSolveOp
      private:
       void ValidateInputTensors(OpKernelContext* ctx, const Tensor& in0,
                                 const Tensor& in1) override {
    +    const auto in0_num_dims = in0.dims();
         OP_REQUIRES(
    -        ctx, in0.dims() >= 2,
    -        errors::InvalidArgument("In[0] ndims must be >= 2: ", in0.dims()));
    +        ctx, in0_num_dims >= 2,
    +        errors::InvalidArgument("In[0] ndims must be >= 2: ", in0_num_dims));
     
    +    const auto in1_num_dims = in1.dims();
         OP_REQUIRES(
    -        ctx, in1.dims() >= 2,
    -        errors::InvalidArgument("In[0] ndims must be >= 2: ", in1.dims()));
    +        ctx, in1_num_dims >= 2,
    +        errors::InvalidArgument("In[1] ndims must be >= 2: ", in1_num_dims));
    +
    +    const auto in0_last_dim = in0.dim_size(in0_num_dims - 1);
    +    const auto in0_prev_dim = in0.dim_size(in0_num_dims - 2);
    +    OP_REQUIRES(ctx, in0_last_dim == in0_prev_dim,
    +                errors::InvalidArgument(
    +                    "In[0] matrices in the last dimensions must be square (",
    +                    in0_last_dim, " =/= ", in0_prev_dim, ")"));
       }
     };
     
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.