TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
References
Link | Resource |
---|---|
https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 | Patch Third Party Advisory |
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 | Exploit Patch Third Party Advisory |
https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 | Patch Third Party Advisory |
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 | Exploit Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:25
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75 - Patch, Third Party Advisory | |
References | () https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 - Exploit, Patch, Third Party Advisory |
Information
Published : 2021-11-05 23:15
Updated : 2024-11-21 06:25
NVD link : CVE-2021-41220
Mitre link : CVE-2021-41220
CVE.ORG link : CVE-2021-41220
JSON object : View
Products Affected
- tensorflow
CWE
CWE-416
Use After Free