TI-2021-13021 Aliases CVE-2021-33647 GHSA-wvq3-7rfx-ppf9

Out-of-bounds write in openEuler:mindspore

LOW 35CWE-787Published 2022-06-27 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap allocated buffers.

Why it matters now

EPSS 0.0094 61st percentileScored 2026-11-07

Fix Fixed openEuler:mindspore: 1.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	openEuler:mindspore	0.7.0-beta to before 1.3.0	1.3.0	Patch available	CNA

openEuler:mindspore Vendor— Affected 0.7.0-beta to before 1.3.0 Fixed in 1.3.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mindspore:mindspore::::::openeuler::*	1.0.0 to before 1.3.0	Vulnerable	Mindspore
cpe:2.3:a:mindspore:mindspore:0.7.0:beta::::openeuler::*	0.7.0 beta	Vulnerable	Mindspore

cpe:2.3:a:mindspore:mindspore:*:*:*:*:*:openeuler:*:* Versions 1.0.0 to before 1.3.0 Vulnerable ·Mindspore
cpe:2.3:a:mindspore:mindspore:0.7.0:beta:*:*:*:openeuler:*:* Versions 0.7.0 beta Vulnerable ·Mindspore

Remediation

Fix · CNA openEuler:mindspore Fixed in 1.3.0

Timeline

2026-10-02 Threatist record created from CVE-2021-33647
2026-10-03 Alias added: GHSA-wvq3-7rfx-ppf9

References

Patch 1

https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-008_en.md

TI-2021-13028 When performing the initialization operation of the Split operator, if a dimension in the… CVSS 3.1HIGH 7.5
TI-2021-13027 When performing the derivation shape operation of the SpaceToBatch operator, if there is… CVSS 3.1HIGH 7.5
TI-2021-13026 When the Reduce operator run operation is executed, if there is a value of 0 in the… CVSS 3.1HIGH 7.5
TI-2021-13025 When performing the analytical operation of the DepthwiseConv2D operator, if the… CVSS 3.1HIGH 7.5
TI-2021-13024 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5
TI-2021-13023 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences