NULL Pointer Dereference Affecting tensorflow package, versions [2.5.0,2.5.1)[2.4.0,2.4.3)[,2.3.4)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-TENSORFLOW-1540836
  • published13 Aug 2021
  • disclosed13 Aug 2021
  • creditUnknown

Introduced: 13 Aug 2021

CVE-2021-37643  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade tensorflow to version 2.5.1, 2.4.3, 2.3.4 or higher.

Overview

tensorflow is a machine learning framework.

Affected versions of this package are vulnerable to NULL Pointer Dereference. If a user does not provide a valid padding value to tf.raw_ops.MatrixDiagPartOp, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first. The implementation reads the first value from a tensor buffer without first checking that the tensor has values to read from.

References

CVSS Scores

version 3.1