CVE-2021-41223

EUVD-2021-0445
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
GitHub_MCNA
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Affected Products (NVD)
VendorProductVersion
googletensorflow
𝑥
< 2.4.4
googletensorflow
2.5.0 ≤
𝑥
< 2.5.2
googletensorflow
2.6.0 ≤
𝑥
< 2.6.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr
https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr