Buffer Overflow Vulnerability in NumPy
Summary
CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. Affects numpy versions < 92ebe1e9a6aeb47a881a1226b08218175776f9ea. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular library in the Python ecosystem that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis. However, versions of NumPy prior to 1.19 are vulnerable to a buffer overflow issue.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41496, exists in the array_from_pyobj function of fortranobject.c in NumPy. Attackers can exploit this vulnerability by carefully constructing an array with negative values. This can lead to a buffer overflow, potentially resulting in a Denial of Service (DoS) attack. It is important to note that the vendor does not consider this a vulnerability, as the negative dimensions can only be created by an already privileged user or internally.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, NumPy versions prior to 1.19 are vulnerable to a buffer overflow issue that can be exploited for a Denial of Service attack. It is recommended to update NumPy to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python library that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis.
The vulnerability can be exploited to conduct a Denial of Service (DoS) attack by causing a buffer overflow. However, the negative dimensions required for exploitation can only be created by an already privileged user or internally.
To fix this vulnerability, update NumPy to version 1.19 or later. This update includes a patch that addresses the buffer overflow issue.
No specific workaround has been mentioned for this vulnerability.
The vendor does not consider this vulnerability critical, as the negative dimensions required for exploitation can only be created by an already privileged user or internally.
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
