CVE-2021-41214: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2021-41214) in the shape inference code for tf.ragged.cross function. The vulnerability was discovered and reported by members of the Aivul Team from Qihoo 360, and was patched in November 2021. The issue affected TensorFlow versions prior to 2.7.0, including versions 2.4.x, 2.5.x, and 2.6.x (GitHub Advisory).

The vulnerability stems from undefined behavior in the shape inference code for tf.ragged.cross function, where a reference is bound to a nullptr. This can lead to a crash when the function is called with specific inputs. A proof of concept demonstrates the vulnerability can be triggered using a simple code snippet that calls tf.ragged.cross with a ragged constant and a string value (GitHub Advisory).

The impact of this vulnerability is relatively low. When exploited, it results in a crash of the application due to the null pointer dereference, potentially leading to a denial of service condition (GitHub Advisory).

The issue has been patched in multiple versions: TensorFlow 2.7.0, 2.6.1, 2.5.2, and 2.4.4. Users are advised to upgrade to these patched versions. The fix was implemented in GitHub commit fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8 (GitHub Advisory).