CVE-2021-37692
Segfault on strings tensors with mistmatched dimensions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Segfault on strings tensors with mistmatched dimensions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
CVE-2021-37692- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-0418
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
EUVD-2021-0418- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cmgw-8vpc-rc59
Segfault on strings tensors with mistmatched dimensions, due to Go code
Impact
Under certain conditions, Go code can trigger a segfault in string deallocation.
For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).
To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.
Patches
We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22 (merging #50508).
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a fixing PR.
- Record
GHSA-cmgw-8vpc-rc59- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
CVE-2021-37692- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
CVE-2021-37692- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-cmgw-8vpc-rc59
Segfault on strings tensors with mistmatched dimensions, due to Go code
Impact
Under certain conditions, Go code can trigger a segfault in string deallocation.
For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).
To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.
Patches
We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22 (merging #50508).
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a fixing PR.
- Record
GHSA-cmgw-8vpc-rc59- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2021-37692 No score
Segfault on strings tensors with mistmatched dimensions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
BIT-tensorflow-2021-37692- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10014-1 No score
Security update for tensorflow2
This update for tensorflow fixes the following issues:
Update to TF2 2.6.0 which fixes multiple CVEs (boo#1189423).
- Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has been adapted to all a version in its package name (if %set_ver_suffix is set to 1). This allows multiple versions to exist for one product (not installed). NOTE: basel-skylib1.0.3 does not exist in oS:Factory: basel-skylib in oS:Factory - the base version - is 1.0.3.
- Record
openSUSE-SU-2022:10014-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2021-314 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
PYSEC-2021-314- Updated
- 2026-11-02
OSVPYSEC-2021-605 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
PYSEC-2021-605- Updated
- 2026-11-02
OSVPYSEC-2021-803 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, C.TF_TString_Dealloc is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until NewTensor returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.
- Record
PYSEC-2021-803- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
2.5.0rc0 up to 2.5.1 | 2.5.1 |
tensorflow-cpuPyPI |
2.5.0rc0 up to 2.5.1 | 2.5.1 |
tensorflow-gpuPyPI |
2.5.0rc0 up to 2.5.1 | 2.5.1 |
tensorflowBitnami |
2.5.0 up to 2.6.0 | 2.6.0 |
tensorflowPyPI |
2.5.0rc0 up to 2.5.1, plus listed versions 2.5.0 |
2.5.1 |
tensorflow-cpuPyPI |
2.5.0rc0 up to 2.5.1, plus listed versions 2.5.0 |
2.5.1 |
tensorflow-gpuPyPI |
2.5.0rc0 up to 2.5.1, plus listed versions 2.5.0 |
2.5.1 |
tensorflowPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bazel-skylib1.0.3SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
bazel-skylib1.0.3openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37692 is a medium vulnerability (CVSS 5.5) in Google Tensorflow, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in tensorflow 2.5.1.
References
github.com/tensorflow/tensorflow/security/advisories/GHSA-cmgw-8vpc-rc59
nvd.nist.gov/vuln/detail/CVE-2021-37692
Show 178 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/U25ZU2T5T4LOLSIYIMGC5PLU4PQQMJE5
bugzilla.suse.com/1173128
suse.com/security/cve/CVE-2020-26266