CVE-2021-41495: Null Pointer Dereference in numpy.sort
Summary
CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively cre... Affects numpy versions < 1.19.1. Fixed in 1.19.1. How to fix ↓
Also tracked for
- numpy · Debian:11
The same CVE-2021-41495 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NumPy is a popular library for numerical computing in Python. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. The vulnerability affects versions of NumPy prior to 1.19.1. The PyArray_DescrNew function in the numpy.sort module is susceptible to a Null Pointer Dereference vulnerability due to missing return-value validation. This vulnerability allows attackers to conduct Denial of Service (DoS) attacks by repetitively creating sort arrays.
Vulnerability Detail
The Null Pointer Dereference vulnerability in numpy.sort arises from the PyArray_DescrNew function's failure to validate return values. This oversight enables attackers to exploit the vulnerability by repeatedly generating sort arrays. By leveraging this vulnerability, an attacker can launch Denial of Service attacks, potentially disrupting the availability of affected systems. It is important to note that this vulnerability only affects versions of NumPy prior to 1.19.1.
How To Fix
Minimum fixed version
1.19.1
This is the first release that contains the fix.
pip install --upgrade "numpy==1.19.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually validate the return values of the PyArray_DescrNew function before using them. Here is an example of how to implement this workaround in Python:
import numpy as np
# Validate return value
array_descr = np.PyArray_DescrNew()
if array_descr is not None:
# Use the array_descr object
...
Conclusion
The Null Pointer Dereference vulnerability in numpy.sort can be mitigated by updating the NumPy package to version 1.19.1 or later. Users can also manually validate return values as a temporary workaround. It is crucial to promptly address this vulnerability to prevent potential Denial of Service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
The vulnerability allows attackers to conduct Denial of Service attacks by repeatedly creating sort arrays, potentially disrupting the availability of affected systems.
Versions of NumPy prior to 1.19.1 are vulnerable to this issue.
Yes, updating the NumPy package to version 1.19.1 or later resolves this vulnerability.
Yes, users can manually validate the return values of the PyArray_DescrNew function before using them as a temporary workaround.
You can find more information about this vulnerability in the NumPy advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/numpy/PYSEC-2021-856.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
