VIR Vulnerability Intelligence Relay

CVE-2021-41198

high
Published 2021-11-10 · Modified 2023-12-06
CVSS v3
—
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2
—
VIR risk
8.0

Description

TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-41198

OS impact
OSVersionStatusFixed in
arch archfixed2.6.1-1
debian debianforkyfixed0
debian debiansidfixed0

Package impact
EcosystemPackageVulnerableFixed
python PyPItensorflow-cpu>=2.5.0,<2.5.22.5.2
python PyPItensorflow<2.4.42.4.4
python PyPItensorflow-gpu<2.4.42.4.4
python PyPItensorflow>=2.6.0,<2.6.12.6.1
python PyPItensorflow-gpu>=2.5.0,<2.5.22.5.2
python PyPItensorflow>=2.5.0,<2.5.22.5.2
python PyPItensorflow-cpu<2.4.42.4.4
python PyPItensorflow-cpu>=2.6.0,<2.6.12.6.1
python PyPItensorflow-gpu>=2.6.0,<2.6.12.6.1
python PyPItensorflow<9294094df6fea79271778eb7e7ae1bad8b5ef98f||>=2.7.0rc0,<2.7.09294094df6fea79271778eb7e7ae1bad8b5ef98f
python PyPItensorflow-cpu<9294094df6fea79271778eb7e7ae1bad8b5ef98f||>=2.7.0rc0,<2.7.09294094df6fea79271778eb7e7ae1bad8b5ef98f
python PyPItensorflow-gpu<9294094df6fea79271778eb7e7ae1bad8b5ef98f||>=2.7.0rc0,<2.7.09294094df6fea79271778eb7e7ae1bad8b5ef98f

References

Verify integrity in audit chain (admin only). AS-IS.