CVE-2021-37688: TensorFlow GPU - Null Pointer Dereference Denial of Service
Summary
CVE-2021-37688: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 15691e456c7dc9bd6be203b09765b063bf4a380c
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-37688 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for training and inference of machine learning models.
Vulnerability Detail
The vulnerability identified as CVE-2021-37688 affects TensorFlow GPU versions 2.3.0 to 2.4.3 and 2.5.1. An attacker can exploit this vulnerability by crafting a TFLite model that triggers a null pointer dereference. This leads to a crash and denial of service. The vulnerable code can be found in the optimized_ops.h file of the TensorFlow Lite kernel implementation. The issue arises due to an unconditional dereference of a pointer. The impact of this vulnerability is the disruption of TensorFlow GPU applications, potentially leading to service unavailability and loss of data.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-gpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-gpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the provided patches or update to the fixed versions of TensorFlow GPU.
Conclusion
The identified vulnerability in TensorFlow GPU (CVE-2021-37688) can be exploited to trigger a null pointer dereference, leading to a crash and denial of service. Users are advised to update their TensorFlow GPU installations to the patched versions once they are released. It is important to stay informed about security updates and follow best practices for securing machine learning applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPU acceleration for faster machine learning computations.
The vulnerability can result in a crash and denial of service, disrupting TensorFlow GPU applications and potentially causing service unavailability and data loss.
The vulnerability affects TensorFlow GPU versions 2.3.0 to 2.4.3 and 2.5.1.
To fix this vulnerability, update your TensorFlow GPU installation to the patched versions once they are released. Follow the official TensorFlow documentation for the latest updates and upgrade instructions.
There is no specific workaround mentioned for this vulnerability. Applying the provided patches or updating to the fixed versions is recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
