CVE-2021-41196

Advisory

Intel-tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41196: In affected versions, the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix is included in TensorFlow 2.7.0.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m539-j985-hcr8

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41196
• https://github.com/tensorflow/tensorflow/commit/12b1ff82b3f26ff8de17e58703231d5a02ef1b8b
• https://github.com/tensorflow/tensorflow/issues/51936
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m539-j985-hcr8