CVE-2021-41197

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an int64t. If an overflow occurs,...

`CHECK` failure in depthwise ops via overflows

Impact The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf input = tf.constant1, shape=1, 4, 4, 3, dtype=tf.float32 filtersizes =...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +517 more potentially affected by CVE-2021-41197 via tensorflow (>=2.0.0, <=2.6.3)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2021-41197 Source advisory: GHSA-MW6J-HH29-H379...

GHSA-RRX2-R989-2C43 Integer overflows in Tensorflow

Impact The implementations of SparseCwise ops are vulnerable to integer overflows. These can be used to trigger large allocations so, OOM based denial of service or CHECK-fails when building new TensorShape objects so, assert failures based denial of service: python import tensorflow as tf import...

Integer overflows in Tensorflow

Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects so, an assert failure based denial of service: python import tensorflow as tf import numpy as np tf.rawops.AddManySparseToTensorsMap...

GHSA-6445-FM66-FVQ2 Integer overflows in Tensorflow

Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects so, an assert failure based denial of service: python import tensorflow as tf import numpy as np tf.rawops.AddManySparseToTensorsMap...

Integer Overflow or Wraparound in TensorFlow

Impact The Grappler component of TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure in constant folding: cc for const auto& outputprop : outputprops const PartialTensorShape outputshapeoutputprop.shape; // ... The outputprop tensor has a shape that is controlled b...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), bent (>=0.0.9, <=0.0.27) +32 more potentially affected by CVE-2021-41197 via tensorflow-gpu (>=2.0.0, <=2.5.1)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 and more Source cves: CVE-2021-41197 Source advisory: GHSA-WCV5-VRVR-3RX2...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +471 more potentially affected by CVE-2021-41197 via tensorflow (>=2.0.0, <=2.5.2)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2021-41197 Source advisory: GHSA-WCV5-VRVR-3RX2...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +9 more potentially affected by CVE-2021-41197 via tensorflow-gpu (>=2.6.0, <=2.6.2)

tensorflow-gpu PYPI version =2.6.0, =1.1.2, =0.1.5, =0.1.0, =0.9.0, =1.0.5, =1.0.6 Source cves: CVE-2021-41197 Source advisory: GHSA-WCV5-VRVR-3RX2...

GHSA-WCV5-VRVR-3RX2 Integer Overflow or Wraparound in TensorFlow

Impact The Grappler component of TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure in constant folding: cc for const auto& outputprop : outputprops const PartialTensorShape outputshapeoutputprop.shape; // ... The outputprop tensor has a shape that is controlled b...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +417 more potentially affected by CVE-2021-41197 via tensorflow (>=2.0.0, <=2.4.2)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2021-41197 Source advisory: OSV:GHSA-PRCG-WP5Q-RV7P...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), pycnet-audio (>=0.5.1, <=0.5.8) +2 more potentially affected by CVE-2021-41197 via tensorflow-cpu (>=2.1.0, <=2.3.1)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2021-41197 Source advisory: OSV:GHSA-PRCG-WP5Q-RV7P...

bent (>=0.0.9, <=0.0.27), tensorflow-recommenders-addons-gpu (>=0.3.0, <=0.4.1) potentially affected by CVE-2021-41197 via tensorflow-gpu (2.5.1)

tensorflow-gpu PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - bent =0.0.9, =0.3.0, =0.4.1 Source cves: CVE-2021-41197 Source advisory: OSV:GHSA-PRCG-WP5Q-RV7P...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2021-41197 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +25 more potentially affected by CVE-2021-41197 via tensorflow (2.6.0)

tensorflow PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alwakeupword 1.0.0 - armadillin =0.0.2, =0.0.9, =0.2.0, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =0.10.27, =0.12.1, =0.12.3 and more Source...

iqradre (>=0.1.5, <=0.2.1), lurara (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2021-41197 via tensorflow-gpu (2.6.0)

tensorflow-gpu PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - iqradre =0.1.5, =0.1.0, =0.9.0, =1.0.5, =1.0.6 Source cves: CVE-2021-41197 Source advisory: GHSA-PRCG-WP5Q-RV7P...

arekit (>=0.21.0, <=0.22.1), arenets (>=0.23.0, <=0.23.1) +19 more potentially affected by CVE-2021-41197 via tensorflow-gpu (1.14.0)

tensorflow-gpu PYPI version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - arekit =0.21.0, =0.23.0, =1.0.0, =0.0.1, =0.1.6, =0.1.0, =0.0.6, =1.0.1, =1.0.2 - ocrd-anybaseocr 0.0.1 and more Source cves:...

autogan (0.0.5), deepctr (0.3.3) +8 more potentially affected by CVE-2021-41197 via tensorflow (1.12.3)

tensorflow PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - autogan 0.0.5 - deepctr 0.3.3 - opveclib 1.0.0 - polyaxon-lib =0.0.3, =0.14.0a5, =0.13.0, =1.0.1, =1.9.1, =0.1.0, =0.3.1 Source cves:...

alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +25 more potentially affected by CVE-2021-41197 via tensorflow (2.6.0)

tensorflow PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alwakeupword 1.0.0 - armadillin =0.0.2, =0.0.9, =0.2.0, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =0.10.27, =0.12.1, =0.12.3 and more Source...