VYPR
← All advisories
High severityNVD Advisory· Published Aug 12, 2021· Updated Aug 4, 2024

Out of bounds read via null pointer dereference in TensorFlow

CVE-2021-37659

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations). The implementation assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr. We have patched the issue in GitHub commit 93f428fd1768df147171ed674fee1fc5ab8309ec. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.3.42.3.4
tensorflowPyPI
>= 2.4.0, < 2.4.32.4.3
tensorflowPyPI
>= 2.5.0, < 2.5.12.5.1
tensorflow-cpuPyPI
< 2.3.42.3.4
tensorflow-cpuPyPI
>= 2.4.0, < 2.4.32.4.3
tensorflow-cpuPyPI
>= 2.5.0, < 2.5.12.5.1
tensorflow-gpuPyPI
< 2.3.42.3.4
tensorflow-gpuPyPI
>= 2.4.0, < 2.4.32.4.3
tensorflow-gpuPyPI
>= 2.5.0, < 2.5.12.5.1

Affected products

1

Patches

1
93f428fd1768

Fix nullptr deref and heap OOB access in binary cwise ops.

https://github.com/tensorflow/tensorflowMihai MaruseacJul 31, 2021via ghsa
commit
1 file changed · +5 −0
  • tensorflow/core/kernels/cwise_ops_common.h+5 −0 modified
    @@ -265,6 +265,11 @@ class SimpleBinaryOp : public OpKernel {
   void Compute(OpKernelContext* ctx) override {
     const Tensor& in0 = ctx->input(0);
     const Tensor& in1 = ctx->input(1);
+    OP_REQUIRES(
+        ctx, in0.NumElements() == in1.NumElements(),
+        errors::InvalidArgument("The two arguments to a cwise op must have "
+                                "same number of elements, got ",
+                                in0.NumElements(), " and ", in1.NumElements()));
     auto in0_flat = in0.flat<Tin>();
     auto in1_flat = in1.flat<Tin>();
     const Device& eigen_device = ctx->eigen_device<Device>();

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.