AVID-2026-R0727

Description

Reference binding to null pointer in MatrixDiag* ops (CVE-2021-29515)

Details

TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixDiag* operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Reason for inclusion in AVID: CVE-2021-29515 describes a null-pointer dereference in TensorFlow’s MatrixDiag* operations, a software vulnerability in a core AI framework. TensorFlow is a dependency/framework used to build/train/deploy AI systems, placing this as a software supply chain issue in general-purpose AI stacks. The report provides CVE details, affected versions, and a fix, establishing sufficient evidence for an AVID Curation candidate.

References

• NVD entry
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc6c-75p4-hmq4
• https://github.com/tensorflow/tensorflow/commit/a7116dd3913c4a4afd2a3a938573aa7c785fdfc6

Affected or Relevant Artifacts

• Developer: tensorflow
• Deployer: tensorflow
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2021-05-14
• Version: 0.3.3
• AVID Entry