CVE-2021-41220
published 2021-11-05CVE-2021-41220: TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
10.6th percentile
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | — | — | |
| tensorflow | >= 2.6.0 < 2.6.1 | 2.6.1 | |
| intel | optimization_for_tensorflow | >= 0 < ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 | ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 |
| intel | optimization_for_tensorflow | >= 2.6.0 < 2.6.1 | 2.6.1 |
| intel | optimization_for_tensorflow | >= 2.7.0rc0 < 2.7.0 | 2.7.0 |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Use after free / memory leak in `CollectiveReduceV2`
osv·2021-11-10
CVE-2021-41220 [HIGH] Use after free / memory leak in `CollectiveReduceV2`
Use after free / memory leak in `CollectiveReduceV2`
### Impact
The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:
```python
import tensorflow as tf
tf.raw_ops.CollectiveReduceV2(
input=[],
group_size=[-10, -10, -10],
group_key=[-10, -10],
instance_key=[-10],
ordering_token=[],
merge_op='Mul',
final_op='Div')
```
This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed:
```cc
auto done_with_cleanup = [col_params, done = std::move(done)]() {
done();
col_params->Unref();
};
OP_REQUIRES_OK_ASYNC(c,
FillCollectiveParams(col_params, R
GHSA
Use after free / memory leak in `CollectiveReduceV2`
ghsa·2021-11-10
CVE-2021-41220 [HIGH] CWE-416 Use after free / memory leak in `CollectiveReduceV2`
Use after free / memory leak in `CollectiveReduceV2`
### Impact
The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:
```python
import tensorflow as tf
tf.raw_ops.CollectiveReduceV2(
input=[],
group_size=[-10, -10, -10],
group_key=[-10, -10],
instance_key=[-10],
ordering_token=[],
merge_op='Mul',
final_op='Div')
```
This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed:
```cc
auto done_with_cleanup = [col_params, done = std::move(done)]() {
done();
col_params->Unref();
};
OP_REQUIRES_OK_ASYNC(c,
FillCollectiveParams(col_params, R
OSV
CVE-2021-41220: TensorFlow is an open source platform for machine learning
osv·2021-11-05
CVE-2021-41220 CVE-2021-41220: TensorFlow is an open source platform for machine learning
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Debian
CVE-2021-41220: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...
vendor_debian·2021·CVSS 7.8
CVE-2021-41220 [HIGH] CVE-2021-41220: tensorflow - TensorFlow is an open source platform for machine learning. In affected versions...
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5
2021-11-05
Published