LiveActive security incident?Get immediate response
CVE Record

CVE-2021-29518: Session operations in eager mode lead to null pointer dereferences

TensorFlow is an end-to-end open source platform for machine learning. In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference. The implementation(https://github.com/tensorflow/tensorflow/blob/eebb96c2830d48597d055d247c0e9aebaea94cd5/tensorflow/core/kernels/session_ops.cc#L104) dereferences the session state pointer without checking if it is valid. Thus, in eager mode, `ctx->session_state()` is nullptr and the call of the member function is undefined behavior. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

LowCVSS 2.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a low-severity TensorFlow denial-of-service issue. In TensorFlow eager mode, invalid session-related raw operations could hit a null pointer and crash the process. The main business concern is availability of ML workloads that allow local or authenticated users to run TensorFlow operations.

Executive priority

Treat this as routine patching unless TensorFlow is exposed in shared ML platforms or user-executable environments. It has low availability impact and no sourced evidence of active exploitation, but vulnerable ML services should still be moved to fixed TensorFlow releases.

Technical view

CVE-2021-29518 is a CWE-476 null pointer dereference in TensorFlow session operations. In eager mode, ctx->session_state() can be null, but session_ops.cc dereferenced it without validation. CVSS 3.1 is 2.5: local attack vector, high complexity, low privileges, no confidentiality or integrity impact, and low availability impact.

Likely exposure

Exposure is most likely in systems using vulnerable TensorFlow 2.x versions, especially environments where users can execute TensorFlow raw operations. Listed affected ranges are below 2.1.4, 2.2.0 to before 2.2.3, 2.3.0 to before 2.3.3, and 2.4.0 to before 2.4.2.

Exploitation context

The source bundle does not show active exploitation, and KEV is false. Exploitation requires local access with low privileges and high complexity. The plausible outcome is a process crash or limited service disruption, not data theft or code execution, based on the provided CVSS and advisory details.

Researcher notes

The key condition is eager mode with raw session operation calls reaching code that assumed a valid session state. The public sources identify the null dereference and fixed release plan, but do not provide evidence of exploitation in the wild or broader product impact.

Mitigation direction

  • Upgrade TensorFlow to 2.5.0 or a fixed supported patch release.
  • For 2.4, 2.3, 2.2, or 2.1 branches, apply the vendor cherrypicked fixes.
  • Prioritize ML systems where users can run TensorFlow operations.
  • Check TensorFlow advisory and commit history for exact fixed builds.

Validation and detection

  • Inventory TensorFlow versions in lockfiles, SBOMs, containers, notebooks, and deployed ML services.
  • Flag versions matching the affected ranges in the source bundle.
  • Confirm upgraded systems run 2.5.0 or fixed branch patch versions.
  • Review services that allow user-controlled TensorFlow operation execution.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-29518 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.5CVSS 3.1LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L11.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.5Low
CVSS 3.1 vector shape for CVE-2021-29518Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tensorflowtensorflow< 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2Listed
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs