Buffer Overflow Vulnerability in NumPy Package: CVE-2021-41496
Summary
DEBIAN-CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. Affects numpy versions 1:1.19.5-1 – 1:2.3.3+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a widely used open-source library in Python, essential for numerical computations. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. This library is integral to scientific computing and data analysis in Python. However, a vulnerability has been identified in versions prior to 1.19, which could potentially allow attackers to exploit the library under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41496, arises from a buffer overflow in the 'array_from_pyobj' function located in 'fortranobject.c' within NumPy versions less than 1.19. This flaw allows attackers to conduct Denial of Service (DoS) attacks by crafting an array with negative dimensions. Although the vendor does not classify this as a vulnerability, it is important to note that such negative dimensions can only be created by a privileged user or internally, which raises concerns about the integrity of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using negative dimensions when constructing arrays in NumPy. Ensure that all dimensions are non-negative to prevent triggering the buffer overflow.
Conclusion
In summary, CVE-2021-41496 is a buffer overflow vulnerability in the NumPy package that can lead to Denial of Service attacks. Users are encouraged to update to version 1.19 or higher to mitigate this risk. Additionally, avoiding negative dimensions in array construction can serve as a temporary workaround.
See every vulnerability recorded for numpy →
FAQ
CVE-2021-41496 is a buffer overflow vulnerability in the NumPy library that can lead to Denial of Service attacks.
All versions of NumPy prior to 1.19 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that your code does not use negative dimensions when creating arrays as a temporary workaround.
The vendor considers the urgency of this vulnerability as unimportant, but it still poses a risk if exploited by a privileged user.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
