CVE-2021-41220
Assigner: GitHub_M
Published: 2021-11-05T22:20:12
State: PUBLISHED
affected: product: tensorflow
vendor: tensorflow
versions: status: affected
version: >= 2.6.0, < 2.6.1
descriptions: value: TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-416
description: CWE-416: Use After Free
type: CWE
source: advisory: GHSA-gpfh-jvf9-7wg5
discovery: UNKNOWN
title: Use after free in `CollectiveReduceV2`