AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TensorFlowGHSA-9c8h-vvrj-w2p8

Heap OOB in `RaggedGather`

TensorFlow

CVE-2021-37641 · Published Aug 25, 2021 · updated Jul 8, 2026

Medium7.1
Fix: upgrade to 2.3.4 or later (3 fixed versions below)
GitHub advisory

Impact

If the arguments to tf.raw_ops.RaggedGather don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers.

```python

import tensorflow as tf

tf.raw_ops.RaggedGather(

params_nested_splits = [0,0,0],

params_dense_values = [1,1],

indices = [0,0,9,0,0],

OUTPUT_RAGGED_RANK=0)

`

In debug mode, the same code triggers a CHECK failure.

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by params_nested_splits is not an empty list of tensors.

Patches

We have patched the issue in GitHub commit [a2b743f6017d7b97af1fe49087ae15f0ac634373](https://github.com/tensorflow/tensorflow/commit/a2b743f6017d7b97af1fe49087ae15f0ac634373).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

For more information

Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and...

Affected versions

PackageAffectedFixed in
tensorflow
PyPI
< 2.3.42.3.4
>= 2.4.0, < 2.4.32.4.3
>= 2.5.0, < 2.5.12.5.1
Details and references

### Impact If the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. ```python import tensorflow as tf tf.raw_ops.RaggedGather( params_nested_splits = [0,0,0], params_dense_values = [1,1], indices = [0,0,9,0,0], OUTPUT_RAGGED_RANK=0) ``` In debug mode, the same code triggers a `CHECK` failure. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by `params_nested_splits` is not an empty list of tensors. ### Patches We have patched the issue in GitHub commit [a2b743f6017d7b97af1fe49087ae15f0ac634373](https://github.com/tensorflow/tensorflow/commit/a2b743f6017d7b97af1fe49087ae15f0ac634373). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-125
Also known as
BIT-tensorflow-2021-37641, CVE-2021-37641, PYSEC-2021-263, PYSEC-2021-554, PYSEC-2021-752

More TensorFlow advisories

All TensorFlow
High 7.3Aug 25, 2021Heap out of bounds access in sparse reduction operationsCVE-2021-37635fixed in 2.3.4 +2Medium 5.5Aug 25, 2021Floating point exception in `SparseDenseCwiseDiv`CVE-2021-37636fixed in 2.3.4 +2High 7.7Aug 25, 2021Null pointer dereference in `CompressElement`CVE-2021-37637fixed in 2.3.4 +2High 7.7Aug 25, 2021Null pointer dereference in `RaggedTensorToTensor`CVE-2021-37638fixed in 2.3.4 +2High 8.4Aug 25, 2021Null pointer dereference and heap OOB read in operations restoring tensorsCVE-2021-37639fixed in 2.3.4 +2Medium 5.5Aug 25, 2021Integer division by 0 in sparse reshapingCVE-2021-37640fixed in 2.3.4 +2