Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. tensorflow-cpu
  4. ›
  5. CVE-2021-37692

CVE-2021-37692: Segfault on strings tensors with mistmatched dimensions, due to Go code

August 25, 2021 (updated November 13, 2024)

Under certain conditions, Go code can trigger a segfault in string deallocation.

For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn’t checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).

To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.

References

  • github.com/advisories/GHSA-cmgw-8vpc-rc59
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-605.yaml
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-803.yaml
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-314.yaml
  • github.com/tensorflow/tensorflow
  • github.com/tensorflow/tensorflow/commit/8721ba96e5760c229217b594f6d2ba332beedf22
  • github.com/tensorflow/tensorflow/pull/50508
  • github.com/tensorflow/tensorflow/security/advisories/GHSA-cmgw-8vpc-rc59
  • nvd.nist.gov/vuln/detail/CVE-2021-37692

Code Behaviors & Features

Detect and mitigate CVE-2021-37692 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2.5.0rc0 before 2.5.1

Fixed versions

  • 2.5.1

Solution

Upgrade to version 2.5.1 or above.

Impact 5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation

Source file

pypi/tensorflow-cpu/CVE-2021-37692.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:28 +0000.