{"schema_version":"1.9.0","id":"GHSA-cqv6-3phm-hcwx","published":"2021-11-10T18:50:17Z","modified":"2026-07-08T06:28:40.863083632Z","aliases":["BIT-tensorflow-2021-41221","CVE-2021-41221","PYSEC-2021-413","PYSEC-2021-630","PYSEC-2021-828"],"summary":"Access to invalid memory during shape inference in `Cudnn*` ops","details":"### Impact\nThe [shape inference code](https://github.com/tensorflow/tensorflow/blob/9ff27787893f76d6971dcd1552eb5270d254f31b/tensorflow/core/ops/cudnn_rnn_ops.cc) for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow:\n\n```python\nimport tensorflow as tf\n\n@tf.function\ndef func():\n  return tf.raw_ops.CudnnRNNV3(\n    input=[0.1, 0.1],\n    input_h=[0.5],\n    input_c=[0.1, 0.1, 0.1], \n    params=[0.5, 0.5],\n    sequence_lengths=[-1, 0, 1])\n  \nfunc() \n```\n  \nThis occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values:\n\n```cc\nauto input_shape = c->input(0);\nauto input_h_shape = c->input(1);\nauto seq_length = c->Dim(input_shape, 0);\nauto batch_size = c->Dim(input_shape, 1);  // assumes rank >= 2\nauto num_units = c->Dim(input_h_shape, 2); // assumes rank >= 3\n``` \n\n### Patches\nWe have patched the issue in GitHub commit [af5fcebb37c8b5d71c237f4e59c6477015c78ce6](https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6).\n\nThe fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.","affected":[{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}],"versions":["2.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}]}],"versions":["2.5.0","2.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.15.5","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}],"versions":["2.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}]}],"versions":["2.5.0","2.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4"}]}],"versions":["1.15.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}],"versions":["2.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}]}],"versions":["2.5.0","2.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.15.5","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-cqv6-3phm-hcwx/GHSA-cqv6-3phm-hcwx.json"}}],"references":[{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cqv6-3phm-hcwx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41221"},{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-630.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-828.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-413.yaml"},{"type":"PACKAGE","url":"https://github.com/tensorflow/tensorflow"}],"database_specific":{"cwe_ids":["CWE-120","CWE-787"],"github_reviewed":true,"github_reviewed_at":"2021-11-08T22:02:26Z","nvd_published_at":"2021-11-05T23:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}