CVE-2021-41223

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
GitHub_MCNA
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
VendorProductVersion
googletensorflow
𝑥
< 2.4.4
googletensorflow
2.5.0 ≤
𝑥
< 2.5.2
googletensorflow
2.6.0 ≤
𝑥
< 2.6.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr
https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr