Null Pointer Dereference vulnerability in numpy.sort in NumPy
Summary
CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively cre... Affects numpy versions < 92ebe1e9a6aeb47a881a1226b08218175776f9ea. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular library for numerical computing in Python. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. The vulnerability affects the numpy.sort function in NumPy versions prior to 1.19. It is caused by missing return-value validation in the PyArray_DescrNew function, leading to a null pointer dereference. This vulnerability can be exploited to conduct denial-of-service (DoS) attacks by repeatedly creating sort arrays.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41495, arises due to the absence of return-value validation in the PyArray_DescrNew function. While the missing validation is a concern, it is important to note that an error can only occur if the user exhausts memory. Therefore, the user would already need to have privileged access to exploit this vulnerability. Additionally, constructing an attack specifically targeting the memory exhaustion at this particular point is considered practically impossible.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability requires memory exhaustion to be exploited, implementing a workaround may not be necessary. However, to mitigate the risk, it is advisable to ensure that the system has sufficient memory resources available to prevent potential DoS attacks.
Conclusion
In conclusion, the null pointer dereference vulnerability in numpy.sort in NumPy versions prior to 1.19 can be mitigated by updating the affected package and ensuring sufficient memory resources. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python library used for numerical computing, providing support for large, multi-dimensional arrays and matrices.
The vulnerable function is numpy.sort, which is used for sorting arrays in NumPy.
A null pointer dereference vulnerability occurs when a program attempts to access or dereference a null pointer, leading to a crash or unexpected behavior.
The vulnerability can be exploited to conduct denial-of-service (DoS) attacks by repeatedly creating sort arrays, potentially causing the system to become unresponsive.
Updating the affected NumPy package to version 1.19 or higher will fix the vulnerability. It is also recommended to ensure sufficient memory resources are available to mitigate the risk of DoS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
