CVE-2021-33430: Buffer Overflow in NumPy 1.9.x
Summary
CVE-2021-33430: A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a De... Affects numpy versions >= 1.9.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Also tracked for
- numpy · Debian:11
The same CVE-2021-33430 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. NumPy is widely used in various domains, including machine learning, data science, and numerical computations. However, versions 1.9.x of NumPy are vulnerable to a Buffer Overflow issue in the PyArray_NewFromDescr_int function of ctors.c. This vulnerability can be exploited by a malicious user to cause a Denial of Service (DoS) attack.
Vulnerability Detail
The Buffer Overflow vulnerability in NumPy 1.9.x arises when arrays with large dimensions (over 32) are specified from Python code. The PyArray_NewFromDescr_int function in ctors.c does not properly handle these large dimensions, leading to a buffer overflow. An attacker can craft a malicious input that triggers this vulnerability, causing the program to crash or become unresponsive. This can result in a DoS condition, impacting the availability of the affected system. The vulnerability has been assigned the CVE identifier CVE-2021-33430.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
pip install --upgrade "numpy==1.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to a fixed version of NumPy to resolve the issue.
Conclusion
The Buffer Overflow vulnerability in NumPy 1.9.x can be exploited by a malicious user to cause a Denial of Service (DoS) attack. It is crucial to update to a fixed version of NumPy, such as version 1.10.0 or later, to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with mathematical functions to operate on these arrays.
The vulnerability allows a malicious user to cause a Denial of Service (DoS) attack by exploiting a buffer overflow in NumPy 1.9.x. This can lead to the affected system becoming unresponsive or crashing.
To fix this vulnerability, you should upgrade your NumPy installation to version 1.10.0 or later, which includes the necessary security patches.
No, there is no known workaround for this vulnerability. Updating to a fixed version of NumPy is the recommended solution.
You can find more information about this vulnerability in the NumPy advisory database. The source link is provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
