AVID-2026-R0895

Description

Overflow/crash in tf.range (CVE-2021-41202)

Details

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition will be cast to double and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Reason for inclusion in AVID: CVE-2021-41202 describes a software vulnerability (overflow/crash) in TensorFlow’s tf.range, a core ML framework component. It affects TensorFlow versions used to build/train/deploy AI systems and has a defined CVE with references and fixes. This is clearly a software supply-chain issue (a dependency/library used in AI pipelines) and constitutes a security vulnerability (local exploit with potential availability impact). The report provides sufficient evidence (CVE entry, affected versions, fixes, related commits).

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score	5.5
Base Severity	🟠 Medium
Attack Vector	LOCAL
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-681	CWE-681: Incorrect Conversion between Numeric Types

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-11-05
Version: 0.3.3
AVID Entry