CVE-2021-29542: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a heap buffer overflow vulnerability (CVE-2021-29542) that could be triggered by passing crafted inputs to tf.raw_ops.StringNGrams. The vulnerability was discovered in May 2021 and affected versions prior to 2.5.0 (NVD, GitHub Advisory).

The vulnerability exists in the implementation of the StringNGrams operation where it fails to consider corner cases where input would be split in such a way that the generated tokens should only contain padding elements. If input is such that num_tokens is 0, then, for data_start_index=0 (when left padding is present), the code would result in reading data[-1], causing a heap buffer overflow (GitHub Advisory).

An attacker can trigger a heap buffer overflow by providing specially crafted inputs to the StringNGrams operation. This could potentially lead to memory corruption and possible code execution in the context of the application using TensorFlow (NVD).

The vulnerability has been patched in TensorFlow 2.5.0. The fix was also backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions. The fix was implemented in GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b (GitHub Advisory).