TI-2021-13023 Aliases CVE-2021-33649 GHSA-mqf6-fgq2-v7mh

Out-of-bounds read in openEuler:mindspore

LOW 35CWE-125Published 2022-06-27 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds of input_shape which allocated from heap buffers.

Why it matters now

EPSS 0.0094 61st percentileScored 2026-11-07

Fix Fixed openEuler:mindspore: 1.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	openEuler:mindspore	0.7.0-beta to before 1.3.0	1.3.0	Patch available	CNA

openEuler:mindspore Vendor— Affected 0.7.0-beta to before 1.3.0 Fixed in 1.3.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mindspore:mindspore::::::openeuler::*	1.0.0 to before 1.3.0	Vulnerable	Mindspore
cpe:2.3:a:mindspore:mindspore:0.7.0:beta::::openeuler::*	0.7.0 beta	Vulnerable	Mindspore

cpe:2.3:a:mindspore:mindspore:*:*:*:*:*:openeuler:*:* Versions 1.0.0 to before 1.3.0 Vulnerable ·Mindspore
cpe:2.3:a:mindspore:mindspore:0.7.0:beta:*:*:*:openeuler:*:* Versions 0.7.0 beta Vulnerable ·Mindspore

Remediation

Fix · CNA openEuler:mindspore Fixed in 1.3.0

Timeline

2026-10-02 Threatist record created from CVE-2021-33649
2026-10-03 Alias added: GHSA-mqf6-fgq2-v7mh

References

Patch 1

https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-006_en.md

TI-2021-13028 When performing the initialization operation of the Split operator, if a dimension in the… CVSS 3.1HIGH 7.5
TI-2021-13027 When performing the derivation shape operation of the SpaceToBatch operator, if there is… CVSS 3.1HIGH 7.5
TI-2021-13026 When the Reduce operator run operation is executed, if there is a value of 0 in the… CVSS 3.1HIGH 7.5
TI-2021-13025 When performing the analytical operation of the DepthwiseConv2D operator, if the… CVSS 3.1HIGH 7.5
TI-2021-13024 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5
TI-2021-13022 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences