CVE-2021-41222: TensorFlow SplitV negative arg

Q: Is CVE-2021-41222 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2021-41222, increasing the risk of exploitation.

Q: How to fix CVE-2021-41222?

1. Patch: Upgrade to TensorFlow 2.7.0, or apply cherrypick patches to 2.6.1, 2.5.2, or 2.4.4. 2. Input validation: Add pre-execution checks enforcing that all values in size_splits are strictly non-negative before invoking SplitV. 3. Process isolation: Run TF inference in isolated containers/processes with automatic restart policies (e.g., Kubernetes restartPolicy: Always) to contain crash blast radius. 4. Detection: Monitor for unexpected SIGSEGV terminations in TF serving processes — repeated crashes on inference endpoints may indicate active probing. 5. Audit: Identify all code paths where size_splits values originate from user-controlled input and add sanitization at those ingestion points.

Q: What systems are affected by CVE-2021-41222?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, inference.

Q: What is the CVSS score for CVE-2021-41222?

CVE-2021-41222 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.18%.

CISO Take

A malformed negative value in TensorFlow's SplitV operation triggers a segmentation fault, crashing any process running affected versions (< 2.7.0). Patch as part of your next routine TF upgrade cycle — this is not an emergency unless TensorFlow inference is directly exposed to untrusted user inputs. Risk is limited to availability; there is no evidence of data exfiltration or code execution potential.

What is the risk?

CVSS 5.5 (Medium) reflects the constrained local attack vector — exploitation requires the ability to influence TF operation inputs, which limits exposure significantly. Highest risk surfaces are multi-tenant ML platforms (shared Jupyter environments, CI/CD pipelines accepting user-submitted models) and TF-Serving deployments that process user-controlled tensor shapes. Not in CISA KEV, no active exploitation reported. Treatment: include in routine patching; do not escalate to emergency response unless exposure profile is unusually high.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
195.8K OpenSSF 7.1 3.7K dependents Pushed 2d ago 4% patched ~1372d to patch Full package profile →

Do you use TensorFlow? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

Patch: Upgrade to TensorFlow 2.7.0, or apply cherrypick patches to 2.6.1, 2.5.2, or 2.4.4.
Input validation: Add pre-execution checks enforcing that all values in size_splits are strictly non-negative before invoking SplitV.
Process isolation: Run TF inference in isolated containers/processes with automatic restart policies (e.g., Kubernetes restartPolicy: Always) to contain crash blast radius.
Detection: Monitor for unexpected SIGSEGV terminations in TF serving processes — repeated crashes on inference endpoints may indicate active probing.
Audit: Identify all code paths where size_splits values originate from user-controlled input and add sanitization at those ingestion points.

How is it classified?

DoS Framework Inference AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.1.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.5 - AI System Robustness and Reliability

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2021-41222?

A malformed negative value in TensorFlow's SplitV operation triggers a segmentation fault, crashing any process running affected versions (< 2.7.0). Patch as part of your next routine TF upgrade cycle — this is not an emergency unless TensorFlow inference is directly exposed to untrusted user inputs. Risk is limited to availability; there is no evidence of data exfiltration or code execution potential.

Is CVE-2021-41222 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2021-41222, increasing the risk of exploitation.

How to fix CVE-2021-41222?

1. Patch: Upgrade to TensorFlow 2.7.0, or apply cherrypick patches to 2.6.1, 2.5.2, or 2.4.4. 2. Input validation: Add pre-execution checks enforcing that all values in size_splits are strictly non-negative before invoking SplitV. 3. Process isolation: Run TF inference in isolated containers/processes with automatic restart policies (e.g., Kubernetes restartPolicy: Always) to contain crash blast radius. 4. Detection: Monitor for unexpected SIGSEGV terminations in TF serving processes — repeated crashes on inference endpoints may indicate active probing. 5. Audit: Identify all code paths where size_splits values originate from user-controlled input and add sanitization at those ingestion points.

What systems are affected by CVE-2021-41222?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, inference.

What is the CVSS score for CVE-2021-41222?

CVE-2021-41222 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesinference

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.1.6

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Exploitation Scenario

An attacker with access to a TF-Serving inference endpoint crafts a request invoking SplitV with size_splits containing two or more values where at least one is negative (e.g., [-1, 5]). TensorFlow fails to validate the negative entry, triggering a segfault that crashes the server process. In a shared ML notebook environment (Jupyter Hub, SageMaker Studio), a malicious collaborator submits a notebook cell with a crafted SplitV call, crashing the kernel and disrupting co-workers. In a CI/CD pipeline that evaluates community-contributed models, a poisoned model embedding a SplitV call with negative splits could crash the evaluation runner, delaying deployments or silently skipping security gates.

Weaknesses (CWE)

CWE-682 Incorrect Calculation

CWE-682 — Incorrect Calculation: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

[Implementation] Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
[Implementation] Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

Source: MITRE CWE corpus.