Vulnerability · Published Nov 5, 2021 · Assigned by GitHub_M
CVE-2021-41220Use after free in `CollectiveReduceV2`
High 7.8
In plain English
A high-severity use-after-free in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.6.1 | GHSA-gpfh-jvf9-7wg5 |
| PyPI | tensorflow | 2.6.1, 2.7.0 | PYSEC-2021-412 |
| PyPI | tensorflow-cpu | 2.6.1 | GHSA-gpfh-jvf9-7wg5 |
| PyPI | tensorflow-cpu | 2.6.1, 2.7.0 | PYSEC-2021-629 |
| PyPI | tensorflow-gpu | 2.6.1 | GHSA-gpfh-jvf9-7wg5 |
| PyPI | tensorflow-gpu | 2.6.1, 2.7.0 | PYSEC-2021-827 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | >= 2.6.0, < 2.6.1 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H