CVE-2021-41218

Description

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

How to fix CVE-2021-41218

To remediate CVE-2021-41218, upgrade the affected package to a fixed version below.

—upgrade to 2.4.4 or later
—upgrade to 2.6.1 or later
—upgrade to a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc or later
—upgrade to a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc or later
—upgrade to 2.6.1 or later
—upgrade to a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc or later
—upgrade to 2.6.1 or later

Is CVE-2021-41218 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

>= 2.4.0, < 2.4.4, >= 2.5.0, < 2.5.2, >= 2.6.0, < 2.6.1
>= 2.6.0, < 2.6.1
from 0, < a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc | from 0, < 2.4.4, >= 2.5.0, < 2.5.2, >= 2.6.0, < 2.6.1, >= 2.7.0rc0, < 2.7.0
from 0, < a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc | from 0, < 2.4.4, >= 2.5.0, < 2.5.2, >= 2.6.0, < 2.6.1, >= 2.7.0rc0, < 2.7.0
>= 2.6.0, < 2.6.1
from 0, < a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc | from 0, < 2.4.4, >= 2.5.0, < 2.5.2, >= 2.6.0, < 2.6.1, >= 2.7.0rc0, < 2.7.0
>= 2.6.0, < 2.6.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H