CVE-2021-37690
Use after free and segfault in shape inference functions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Use after free and segfault in shape inference functions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37690- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2021-0416
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
EUVD-2021-0416- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hxh-8cp2-g4hg
Use after free and segfault in shape inference functions
Impact
When running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault.
ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types.
Patches
We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
- Record
GHSA-3hxh-8cp2-g4hg- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37690- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37690- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVGHSA-3hxh-8cp2-g4hg
Use after free and segfault in shape inference functions
Impact
When running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault.
ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types.
Patches
We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
- Record
GHSA-3hxh-8cp2-g4hg- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2021-37690 No score
Use after free and segfault in shape inference functions in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
BIT-tensorflow-2021-37690- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10014-1 No score
Security update for tensorflow2
This update for tensorflow fixes the following issues:
Update to TF2 2.6.0 which fixes multiple CVEs (boo#1189423).
- Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has been adapted to all a version in its package name (if %set_ver_suffix is set to 1). This allows multiple versions to exist for one product (not installed). NOTE: basel-skylib1.0.3 does not exist in oS:Factory: basel-skylib in oS:Factory - the base version - is 1.0.3.
- Record
openSUSE-SU-2022:10014-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2021-312 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-312- Updated
- 2026-11-02
OSVPYSEC-2021-603 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-603- Updated
- 2026-11-02
OSVPYSEC-2021-801 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as MutableHashTableShape) produce extra output information in the form of a ShapeAndType struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. ShapeRefiner is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-801- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4 | 2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflowPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-cpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-gpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflowBitnami |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, 2.5.0 up to 2.5.1 | 2.3.42.4.32.5.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflowPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 9 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-cpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-gpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflowPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
bazel-skylib1.0.3SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
bazel-skylib1.0.3openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37690 is a medium vulnerability (CVSS 6.6) in Google Tensorflow, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in tensorflow 2.3.4.
References
github.com/tensorflow/tensorflow/security/advisories/GHSA-3hxh-8cp2-g4hg
nvd.nist.gov/vuln/detail/CVE-2021-37690
Show 177 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/U25ZU2T5T4LOLSIYIMGC5PLU4PQQMJE5
bugzilla.suse.com/1173128
suse.com/security/cve/CVE-2020-26266