CVE-2021-41195
Description
TensorFlow is an open source platform for machine learning. In affected versions the implementation of tf.math.segment_* operations results in a CHECK-fail related abort (and denial of service) if a segment id in segment_ids is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using AddDim. However, if the number of elements in the tensor overflows an int64_t value, AddDim results in a CHECK failure which provokes a std::abort. Instead, code should use AddDimWithStatus. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | >= 2.6.0, < 2.6.1 | 2.6.1 |
tensorflowPyPI | >= 2.5.0, < 2.5.2 | 2.5.2 |
tensorflowPyPI | < 2.4.4 | 2.4.4 |
tensorflow-cpuPyPI | >= 2.6.0, < 2.6.1 | 2.6.1 |
tensorflow-cpuPyPI | >= 2.5.0, < 2.5.2 | 2.5.2 |
tensorflow-cpuPyPI | < 2.4.4 | 2.4.4 |
tensorflow-gpuPyPI | >= 2.6.0, < 2.6.1 | 2.6.1 |
tensorflow-gpuPyPI | >= 2.5.0, < 2.5.2 | 2.5.2 |
tensorflow-gpuPyPI | < 2.4.4 | 2.4.4 |
Affected products
5- osv-coords4 versions
< 2.4.4+ 3 more
- (no CPE)range: < 2.4.4
- (no CPE)range: >= 2.6.0, < 2.6.1
- (no CPE)range: >= 2.6.0, < 2.6.1
- (no CPE)range: >= 2.6.0, < 2.6.1
- Range: >= 2.6.0, < 2.6.1
Patches
Vulnerability mechanics
References
9- github.com/tensorflow/tensorflow/commit/e9c81c1e1a9cd8dd31f4e83676cab61b60658429nvdPatchThird Party AdvisoryWEB
- github.com/tensorflow/tensorflow/issues/46888nvdPatchThird Party AdvisoryWEB
- github.com/tensorflow/tensorflow/pull/51733nvdPatchThird Party AdvisoryWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-cq76-mxrc-vchhnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-cq76-mxrc-vchhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-41195ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-844.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-846.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-842.yamlghsaWEB
News mentions
0No linked articles in our index yet.