CVE-2021-41220 json
Use after free in `CollectiveReduceV2`
published 2021-11-05 5 y ago modified 2026-09-08 2 mo ago also BIT-tensorflow-2021-41220 , EUVD-2021-0442 , GHSA-gpfh-jvf9-7wg5 , PYSEC-2021-412 , PYSEC-2021-629 , PYSEC-2021-827
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Patch / fix
- pypi tensorflow 2.6.1, 2.7.0
- pypi tensorflow-cpu 2.6.1, 2.7.0
- pypi tensorflow-gpu 2.6.1, 2.7.0
- bitnami tensorflow 2.6.1
- google tensorflow 2.6.1
- tensorflow Arch Linux 2.6.1-1
arch linux advisories AVG-2529
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tensorflow | >=2.6.0, <2.6.1 >=2.7.0rc0, <2.7.0 |
2.6.1 2.7.0 |
| pypi | tensorflow-cpu | >=2.6.0, <2.6.1 >=2.7.0rc0, <2.7.0 |
2.6.1 2.7.0 |
| pypi | tensorflow-gpu | >=2.6.0, <2.6.1 >=2.7.0rc0, <2.7.0 |
2.6.1 2.7.0 |
| bitnami | tensorflow | >=2.6.0, <2.6.1 |
2.6.1 |
Affected products
- tensorflow tensorflow
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75
web, patch, third-party-advisory, advisory
-
github.com
/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5
web, exploit, patch, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-41220
advisory, web
-
github.com
/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-629.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-827.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-412.yaml
web
-
github.com
/tensorflow/tensorflow
package
Sources
- CVE List CVE-2021-41220
- GitHub Advisory GHSA-gpfh-jvf9-7wg5
- NVD CVE-2021-41220
- OSV BIT-tensorflow-2021-41220
- OSV PYSEC-2021-412
- OSV PYSEC-2021-629
- OSV PYSEC-2021-827
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.