CVE-2021-37643: TensorFlow GPU - Null Pointer Dereference in MatrixDiagPartOp
Summary
CVE-2021-37643: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 482da92095c4d48f8784b1f00dda4f81c28d2988
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-37643 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for training and inference of deep learning models.
Vulnerability Detail
The vulnerability (CVE-2021-37643) in TensorFlow GPU arises when the tf.raw_ops.MatrixDiagPartOp function is called without a valid padding value. This triggers a null pointer dereference if the input tensor is empty or produces invalid behavior by ignoring all values after the first. The issue originates from the implementation of the function, which fails to check if the tensor has values to read from before attempting to read the first value. This vulnerability can lead to crashes, incorrect results, or other unexpected behavior in applications that utilize this function.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-gpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-gpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating TensorFlow GPU is not immediately feasible, users can work around the vulnerability by ensuring that a valid padding value is provided when calling the tf.raw_ops.MatrixDiagPartOp function. This can be done by explicitly specifying a padding value or by checking if the input tensor is empty before calling the function.
Conclusion
The vulnerability (CVE-2021-37643) in TensorFlow GPU can lead to crashes, incorrect results, or other unexpected behavior. It is crucial to update TensorFlow GPU to version 2.6.0 or later to fix the issue. Alternatively, users can apply the workaround by providing a valid padding value or checking for an empty input tensor. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPU acceleration for faster computation in machine learning tasks.
The tf.raw_ops.MatrixDiagPartOp function is used to extract the diagonal elements of a matrix.
If a valid padding value is not provided, the vulnerability triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first.
To fix the vulnerability, update your TensorFlow GPU installation to version 2.6.0 or later. Alternatively, ensure that a valid padding value is provided when calling the tf.raw_ops.MatrixDiagPartOp function.
Yes, if updating TensorFlow GPU is not immediately feasible, you can work around the vulnerability by providing a valid padding value when calling the tf.raw_ops.MatrixDiagPartOp function or by checking if the input tensor is empty before calling the function.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
