CVE-2021-37667: TensorFlow - Null Pointer Dereference in tf.raw_ops.UnicodeEncode
Summary
CVE-2021-37667: Reference binding to nullptr in unicode encoding in TensorFlow. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37667 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow is widely used in various industries and research domains.
Vulnerability Detail
The vulnerability (CVE-2021-37667) in TensorFlow allows an attacker to cause undefined behavior by binding a reference to a null pointer in the tf.raw_ops.UnicodeEncode function. The issue arises due to the implementation of the function, which reads the first dimension of the input_splits tensor without validating if the tensor is empty. This vulnerability can be exploited to trigger unexpected behavior or crashes in TensorFlow applications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating to the patched version is the recommended solution.
Conclusion
The vulnerability (CVE-2021-37667) in TensorFlow can be mitigated by updating to the latest patched version or applying the relevant patches. It is important to keep TensorFlow installations up to date to ensure the security and stability of machine learning applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
This vulnerability can be exploited by an attacker to cause undefined behavior or crashes in TensorFlow applications.
To fix this vulnerability, update TensorFlow to the latest patched version (2.6.0 or higher) or apply the relevant patches.
Yes, older versions including 2.5.0, 2.4.0, and 2.3.0 are affected. It is recommended to update to the latest patched version.
You can find more information about this vulnerability in the official TensorFlow security advisory or the CVE entry (CVE-2021-37667).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
