Buffer Overflow Vulnerability in NumPy: Denial of Service Risk
Summary
CVE-2021-33430: A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a De... Affects numpy versions >= 07601a64cdfeb1c0247bde1294ad6380413cab66, <= edb902cdc6573553afcf11047ecdfb447e444322. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a widely-used open-source library in Python for numerical computing, providing support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is a fundamental package for scientific computing in Python, enabling efficient data manipulation and analysis. However, certain versions of NumPy (specifically 1.9.x) are susceptible to a buffer overflow vulnerability that can lead to denial of service under specific conditions.
Vulnerability Detail
A Buffer Overflow vulnerability exists in NumPy 1.9.x within the PyArray_NewFromDescr_int function of ctors.c. This issue arises when users specify arrays with large dimensions (over 32) from Python code. Although the vendor does not classify this as a significant vulnerability, it could allow a malicious user to cause a denial of service. The conditions to trigger this vulnerability are limited, requiring the use of uncommon API features (such as complicated structured dtypes), which are unlikely to be accessible to unprivileged users. The CVSS score for this vulnerability is 5.3, indicating a moderate risk level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider limiting the use of large dimension arrays or avoiding the use of complicated structured dtypes in your code to mitigate the risk of triggering the buffer overflow.
Conclusion
In summary, the buffer overflow vulnerability in NumPy 1.9.x poses a risk of denial of service under specific conditions. Users are advised to upgrade to the latest version to mitigate this risk. Additionally, temporary workarounds can be employed until an upgrade is possible. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for numpy →
FAQ
A buffer overflow vulnerability occurs when a program writes more data to a block of memory, or buffer, than it was allocated for. This can lead to unexpected behavior, including crashes or security breaches.
If exploited, this vulnerability can lead to a denial of service, causing your application to crash or become unresponsive, especially when handling large arrays.
Versions of NumPy prior to 1:1.21.4-2 are affected by this vulnerability. Check your installed version and upgrade if necessary.
If an immediate upgrade is not feasible, avoid using large dimension arrays and complicated structured dtypes in your code as a temporary workaround.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
