1. CVE-Search
  2. CVE-2021-41221
ID CVE-2021-41221
Summary TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
References
Vulnerable Configurations
  • cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:-:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:lite:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc0:*:*:lite:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:lite:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc1:*:*:lite:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:lite:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc2:*:*:lite:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:lite:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc3:*:*:lite:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:-:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.0:rc4:*:*:-:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.0:-:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.0:rc0:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.6.0:-:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.6.0:-:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.6.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.6.0:rc0:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.6.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.6.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.6.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.6.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
  • cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 10-11-2021 - 13:19)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
Last major update 10-11-2021 - 13:19
Published 05-11-2021 - 23:15
Last modified 10-11-2021 - 13:19
Back to Top