CVE-2021-41225

Advisory

TensorFlow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41225: In affected versions, TensorFlow's Grappler optimizer has a use of unitialized variable. If the 'train_nodes' vector (obtained from the saved model that gets optimized) does not contain a 'Dequeue' node, then 'dequeue_node' is left unitialized. The fix is also included in TensorFlow 2.7.0.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw
https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3

Affected package

Affected versions

Fixed versions

Vulnerability changelog

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. See CVE-2021-41225.


CONFIRM:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw
MISC:https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3: https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3

Resources

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw
• https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41225