CVE-2021-37681: TensorFlow SVDF Null Pointer Error
Summary
CVE-2021-37681: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-cpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 5b048e87e4e55990dae6b547add4dae59f4e1c76
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37681 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow includes TFLite, a lightweight version of TensorFlow designed for mobile and embedded devices. TFLite includes an implementation of SVDF (Singular Value Decomposition Filter) for processing sequential data. SVDF is used in various machine learning tasks such as speech recognition and natural language processing.
Vulnerability Detail
The implementation of SVDF in TFLite is vulnerable to a null pointer error. The GetVariableInput function in the SVDF implementation can return a null pointer, but the GetTensorData function assumes that the argument is always a valid tensor. Additionally, the GetVariableInput function calls GetMutableInput, which might also return a null pointer, leading to a null pointer exception when evaluating the tensor->is_variable expression. This vulnerability can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-cpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-cpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched version of TensorFlow as soon as possible.
Conclusion
The vulnerability in TensorFlow's SVDF implementation has been identified and patched. Users are advised to update their TensorFlow installation to version 2.6.0 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
TFLite is a lightweight version of TensorFlow designed for mobile and embedded devices.
SVDF (Singular Value Decomposition Filter) is an algorithm used for processing sequential data in machine learning tasks such as speech recognition and natural language processing.
A null pointer error occurs when a program tries to access a memory location that is null (i.e., does not point to any valid object or data). This can lead to crashes or undefined behavior.
This vulnerability can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
