TI-2021-13024 Aliases CVE-2021-33650 GHSA-84w2-mxww-qhfg

Out-of-bounds read in openEuler:mindspore

LOW 35CWE-125Published 2022-06-27 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers.

Why it matters now

EPSS 0.0094 61st percentileScored 2026-11-07

Fix Fixed openEuler:mindspore: 1.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	openEuler:mindspore	1.2.0 to before 1.3.0	1.3.0	Patch available	CNA

openEuler:mindspore Vendor— Affected 1.2.0 to before 1.3.0 Fixed in 1.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mindspore:mindspore::::::openeuler::*	1.2.0 to before 1.3.0	Vulnerable	Mindspore

cpe:2.3:a:mindspore:mindspore:*:*:*:*:*:openeuler:*:* Versions 1.2.0 to before 1.3.0 Vulnerable ·Mindspore

Remediation

Fix · CNA openEuler:mindspore Fixed in 1.3.0

Timeline

2026-10-02 Threatist record created from CVE-2021-33650
2026-10-03 Alias added: GHSA-84w2-mxww-qhfg

References

Patch 1

https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-005_en.md

TI-2021-13028 When performing the initialization operation of the Split operator, if a dimension in the… CVSS 3.1HIGH 7.5
TI-2021-13027 When performing the derivation shape operation of the SpaceToBatch operator, if there is… CVSS 3.1HIGH 7.5
TI-2021-13026 When the Reduce operator run operation is executed, if there is a value of 0 in the… CVSS 3.1HIGH 7.5
TI-2021-13025 When performing the analytical operation of the DepthwiseConv2D operator, if the… CVSS 3.1HIGH 7.5
TI-2021-13023 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5
TI-2021-13022 Out-of-bounds read in openEuler:mindspore CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences