CVE-2021-29530: Invalid validation in `SparseMatrixSparseCholesky` in TensorFlow
Summary
CVE-2021-29530: Invalid validation in SparseMatrixSparseCholesky. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29530 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. The SparseMatrixSparseCholesky function is a part of TensorFlow's linear algebra operations and is used for performing sparse matrix factorization. This vulnerability in the function allows an attacker to trigger a null pointer dereference by providing an invalid permutation argument.
Vulnerability Detail
The vulnerability arises due to improper validation of input arguments in the SparseMatrixSparseCholesky function. When an attacker supplies an invalid permutation to the function, it fails to properly validate the input, leading to a null pointer dereference. This can be exploited to cause a denial of service (DoS) attack by crashing the application or potentially executing arbitrary code. The vulnerability has a CVSS score of 2.5, indicating a low severity level.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid passing an empty permutation argument to the SparseMatrixSparseCholesky function. By providing a valid permutation, the vulnerability can be bypassed. Here is an example of a valid permutation:
import tensorflow as tf
permutation = tf.constant([[0]], dtype=tf.int32)
Conclusion
The vulnerability in TensorFlow's SparseMatrixSparseCholesky function can be mitigated by updating to the latest patched version of TensorFlow. It is recommended to promptly update the framework to ensure the security and stability of machine learning applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
The SparseMatrixSparseCholesky function is a part of TensorFlow's linear algebra operations and is used for performing sparse matrix factorization.
A null pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer, leading to a crash or potentially exploitable behavior.
The CVSS score of this vulnerability is 2.5, indicating a low severity level.
To fix this vulnerability, update your TensorFlow installation to version 2.5.0 or one of the patched versions (2.4.2, 2.3.3, 2.2.3, or 2.1.4).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
