CVE-2021-37663: TensorFlow GPU - Incomplete Validation in QuantizeV2
Summary
CVE-2021-37663: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 6da6620efad397c85493b8f8667b821403516708
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-37663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation. It is widely used in various industries for training and inference of machine learning models.
Vulnerability Detail
The vulnerability (CVE-2021-37663) exists in TensorFlow GPU due to incomplete validation in the tf.raw_ops.QuantizeV2 function. This vulnerability can be exploited by an attacker to trigger undefined behavior or access data outside the bounds of heap allocated arrays. The issue arises from the lack of validation for the min_range and max_range inputs, which should have the same non-zero number of elements. If the axis parameter is provided, additional validation should be performed to ensure it is within the range of the input tensor's rank, and the lengths of min_range and max_range match the axis dimension of the input tensor. This vulnerability can potentially lead to memory corruption, crashes, or unauthorized access to sensitive data.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-gpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-gpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update to the latest version of TensorFlow GPU.
Conclusion
The vulnerability (CVE-2021-37663) in TensorFlow GPU poses a risk of memory corruption, crashes, or unauthorized data access. It is crucial to update to the latest patched version of TensorFlow GPU (2.6.0 or later) or apply the backported patches for older versions (2.5.1, 2.4.3, and 2.3.4) to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPUs for accelerated computation, enabling faster training and inference of machine learning models.
This vulnerability can lead to memory corruption, crashes, or unauthorized access to data, potentially compromising the integrity and security of machine learning models and sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file without requiring access to the code or installation.
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update to the latest version of TensorFlow GPU.
You can find more information about this vulnerability in the TensorFlow GitHub repository (https://github.com/tensorflow/tensorflow) and the official TensorFlow documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
