CVE-2021-41195: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2021-41195) in the implementation of tf.math.segment_* operations. The vulnerability was discovered and disclosed on November 5, 2021. When a segment id in segment_ids is large, it results in a CHECK-fail related abort and denial of service. This affects TensorFlow versions prior to 2.4.4, 2.5.2, 2.6.1, and 2.7.0 (GitHub Advisory, NVD).

The vulnerability stems from the implementation computing the output shape using AddDim. If the number of elements in the tensor overflows an int64_t value, AddDim results in a CHECK failure which triggers a std::abort. The correct implementation should use AddDimWithStatus instead. This issue is similar to CVE-2021-29584 and affects both CPU and GPU implementations (GitHub Advisory).

When exploited, this vulnerability leads to a denial of service condition through application crash. The vulnerability can be triggered when processing segment operations with large segment IDs, causing the application to abort execution (GitHub Advisory).

The vulnerability was patched in TensorFlow versions 2.4.4, 2.5.2, 2.6.1, and 2.7.0. The fix was implemented in GitHub commit e9c81c1e1a9cd8dd31f4e83676cab61b60658429 and merged via pull request #51733. Users are advised to upgrade to the patched versions (GitHub Advisory).