VIR Vulnerability Intelligence Relay

CVE-2021-41202

high
Published 2021-11-10 · Modified 2023-12-06
CVSS v3
—
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2
—
VIR risk
8.0

Description

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-41202

OS impact
OSVersionStatusFixed in
arch archfixed2.6.1-1
debian debianforkyfixed0
debian debiansidfixed0

Package impact
EcosystemPackageVulnerableFixed
python PyPItensorflow>=2.6.0,<2.6.12.6.1
python PyPItensorflow>=2.5.0,<2.5.22.5.2
python PyPItensorflow<2.4.42.4.4
python PyPItensorflow-cpu>=2.6.0,<2.6.12.6.1
python PyPItensorflow-cpu>=2.5.0,<2.5.22.5.2
python PyPItensorflow-cpu<2.4.42.4.4
python PyPItensorflow-gpu>=2.6.0,<2.6.12.6.1
python PyPItensorflow-gpu>=2.5.0,<2.5.22.5.2
python PyPItensorflow-gpu<2.4.42.4.4
python PyPItensorflow<6d94002a09711d297dbba90390d5482b76113899||>=2.7.0rc0,<2.7.01b0e0ec27e7895b9985076eab32445026ae5ca94
python PyPItensorflow-cpu<6d94002a09711d297dbba90390d5482b76113899||>=2.7.0rc0,<2.7.01b0e0ec27e7895b9985076eab32445026ae5ca94
python PyPItensorflow-gpu<6d94002a09711d297dbba90390d5482b76113899||>=2.7.0rc0,<2.7.01b0e0ec27e7895b9985076eab32445026ae5ca94

References

Verify integrity in audit chain (admin only). AS-IS.