CVE-2021-41220 — Vulnetix

CVE-2021-41220 PUBLISHED

TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

EPSS 0.02% · 6.3th percentile

Risk Scores

EPSS Score

0.02%

6.3th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.6.0
Bitnami	tensorflow	2.6.0

Exploit Intelligence

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 (nist-nvd)
https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 (circl)

Timeline

Nov 5, 2021 CVE Published
Nov 6, 2021 EPSS Score
Jan 1, 2022 EPSS Score
Jan 6, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jun 17, 2022 EPSS Score
Aug 12, 2022 EPSS Score
Oct 7, 2022 EPSS Score
Dec 2, 2022 EPSS Score
Jan 27, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 url
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 url
https://nvd.nist.gov/vuln/detail/CVE-2021-41220 url

Open in Interactive Console →