CVE-2021-41204

Advisory

Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41204: In affected versions, during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix is included in TensorFlow 2.7.0.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x
https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659

Affected package

Affected versions

Fixed versions

Vulnerability changelog

TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. See CVE-2021-41204.


CONFIRM:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x
MISC:https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659: https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659

Resources

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x
• https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41204