CVE-2021-41223

Advisory

Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41223: In affected versions, the implementation of 'FusedBatchNorm' kernels is vulnerable to a heap OOB access. The fix is included in TensorFlow 2.7.0.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr
https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda

Affected package

Affected versions

Fixed versions

Vulnerability changelog

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. See CVE-2021-41223.


CONFIRM:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr
MISC:https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda: https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda

Resources

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr
• https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41223