CVE-2021-41221

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412225.5TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is anCVE-2021-412237.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerablCVE-2021-412247.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to CVE-2021-412257.8TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized vaCVE-2021-412267.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a hCVE-2021-412275.5TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be trickedCVE-2021-412287.8TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a codeCVE-2021-412296.5BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory whCVE-2021-41236.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-412308.8Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are noCVE-2021-412317.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DatCVE-2021-412329.8Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection
CVE-2021-41221: High severity, CVSS 7.8 | Vulnix