CVE-2021-41224: TensorFlow-gpu - Heap Out-of-Bounds Access in SparseFillEmptyRows
Summary
CVE-2021-41224: TensorFlow is an open source platform for machine learning. Affects tensorflow-gpu across 5 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 67bfd9feeecfb3c61d80f0e46d89c170fbee682b
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-41224 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-gpu is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for deep learning tasks.
Vulnerability Detail
The vulnerability identified as CVE-2021-41224 affects TensorFlow-gpu. Specifically, the issue lies in the implementation of the SparseFillEmptyRows function. When the size of the indices parameter does not match the size of the values parameter, a heap out-of-bounds access can be triggered. This vulnerability can lead to memory corruption and potentially enable an attacker to execute arbitrary code or cause a denial-of-service condition. The issue has been addressed in TensorFlow 2.7.0, and patches have been backported to TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow-gpu==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow-gpu==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow-gpu==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow-gpu==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update TensorFlow-gpu to the fixed versions mentioned above to mitigate the risk of exploitation.
Conclusion
The vulnerability in TensorFlow-gpu, identified as CVE-2021-41224, can lead to a heap out-of-bounds access and potential memory corruption. To mitigate this risk, it is recommended to update TensorFlow-gpu to version 2.7.0 or apply the respective patches for earlier versions within the supported range. It is important to stay up-to-date with security patches and follow best practices to ensure the security of machine learning applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow-gpu is a variant of TensorFlow that utilizes GPU acceleration for faster machine learning computations. It is commonly used for deep learning tasks.
The vulnerability can lead to a heap out-of-bounds access, potentially resulting in memory corruption. This could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
The vulnerability affects TensorFlow-gpu versions 2.4.4, 2.5.2, 2.6.1, and versions prior to 2.7.0.
To fix this vulnerability, update TensorFlow-gpu to version 2.7.0. If you are using an affected version within the supported range, apply the respective patches for TensorFlow 2.6.1, TensorFlow 2.5.2, or TensorFlow 2.4.4.
No, there is no known workaround for this vulnerability. It is crucial to update TensorFlow-gpu to the fixed versions or apply the patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
