CVE-2021-37658: TensorFlow - Null Pointer Dereference in MatrixSetDiagV* Operations
Summary
CVE-2021-37658: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< ff8894044dfae5568ecbf2ed514c1a37dc394f1b
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37658 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow supports various operations, including matrix manipulation and linear algebra computations. However, a vulnerability has been identified in the MatrixSetDiagV* operations of TensorFlow.
Vulnerability Detail
The vulnerability (CVE-2021-37658) arises from incomplete validation in the implementation of the tf.raw_ops.MatrixSetDiagV* operations. Specifically, there is a lack of validation for the number of elements in the tensor k, which should be either a scalar or a vector. If k is an empty tensor, the code that accesses the first element of the tensor results in undefined behavior, leading to a null pointer dereference. An attacker can exploit this vulnerability to cause the affected TensorFlow operations to exhibit unexpected and potentially malicious behavior.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to update to the fixed versions of TensorFlow as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability (CVE-2021-37658) in TensorFlow's MatrixSetDiagV* operations allows for a null pointer dereference, leading to undefined behavior. It has been addressed in TensorFlow versions 2.6.0, 2.5.1, 2.4.3, and 2.3.4. Users are strongly advised to update their TensorFlow installation to one of the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for developing and deploying machine learning models.
The vulnerability affects TensorFlow versions 2.3.0 and above. Specifically, TensorFlow versions 2.3.0 to 2.3.4, 2.4.0 to 2.4.3, and 2.5.1 are affected.
The vulnerability allows an attacker to cause undefined behavior in TensorFlow operations, potentially leading to unexpected and malicious behavior.
Yes, the vulnerability has been fixed in TensorFlow versions 2.6.0, 2.5.1, 2.4.3, and 2.3.4. Users are advised to update to one of these fixed versions.
You can find more information about this vulnerability in the official TensorFlow advisory (PYSEC-2021-280) available at https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow/PYSEC-2021-280.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
