CVE Vulnerabilities

CVE-2021-41225

Use of Uninitialized Resource

Published: Nov 05, 2021 | Modified: Nov 10, 2021
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
2.1 LOW
AV:L/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

TensorFlow is an open source platform for machine learning. In affected versions TensorFlows Grappler optimizer has a use of unitialized variable. If the train_nodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeue_node is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Weakness

The product uses or accesses a resource that has not been initialized.

Affected Software

Name Vendor Start Version End Version
Tensorflow Google 2.4.0 (including) 2.4.4 (excluding)
Tensorflow Google 2.5.0 (including) 2.5.2 (excluding)
Tensorflow Google 2.6.0 (including) 2.6.1 (excluding)
Tensorflow Google 2.7.0-rc0 (including) 2.7.0-rc0 (including)
Tensorflow Google 2.7.0-rc1 (including) 2.7.0-rc1 (including)

Potential Mitigations

References