Back to Database
Status published
High
CVE-2021-41223
Heap OOB read in `FusedBatchNorm` kernels
Vulnerability Description
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41223
Credits & Attribution
No credits recorded in the NVD database.
References
More from tensorflow
View All →CVE-2024-3660
Arbitrary code injection vulnerability in Keras framework < 2.13
Unknown
0
CVE-2023-33976
TensorFlow segfault in array_ops.upper_bound
High
7.5
CVE-2023-27579
TensorFlow has Floating Point Exception in TFLite in conv kernel
High
7.5
CVE-2023-25801
TensorFlow has double free in Fractional(Max/Avg)Pool
High
8
CVE-2023-25676
TensorFlow has null dereference on ParallelConcat with XLA
High
7.5
Affected Vendor
tensorflow
View all reports →Affected Software
tensorflow
Vulnerable Versions:
>= 2.6.0, < 2.6.1, >= 2.5.0, < 2.5.2, < 2.4.4
Timeline
Official Publish:
November 5th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H