LiveActive security incident?Get immediate response
CVE Record

CVE-2021-37646: Bad alloc in `StringNGrams` caused by integer conversion in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit c283e542a3f422420cfdb332414543b62fc4e4a5. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This TensorFlow flaw can turn a negative n-gram width value into a huge memory request, potentially crashing a process. The main business impact is service disruption, not data theft or tampering. Exposure depends on affected TensorFlow versions and whether untrusted users or workflows can influence StringNGrams inputs.

Executive priority

Treat as a medium operational availability risk. Patch on the normal security maintenance cycle, but expedite for shared ML platforms, multi-tenant notebooks, or services where users can influence TensorFlow preprocessing inputs.

Technical view

CVE-2021-37646 affects tf.raw_ops.StringNGrams. A signed negative ngram_widths value can be implicitly converted to an unsigned allocation size when tstring::reserve calls TF_TString_Reserve, causing excessive allocation. TensorFlow patched this in commit c283e542a3f422420cfdb332414543b62fc4e4a5, with fixes planned for 2.6.0 and supported backports.

Likely exposure

Likely exposure is TensorFlow installations in the affected version ranges that use StringNGrams with user-controlled or otherwise untrusted ngram_widths. Exposure is lower where the operator is unused, inputs are trusted, or deployments already run fixed TensorFlow versions.

Exploitation context

The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact only. The source bundle does not show CISA KEV listing or active exploitation evidence. Do not assume remote exploitation without additional product-specific evidence.

Researcher notes

The issue is a CWE-681 integer conversion flaw in TensorFlow StringNGrams allocation logic. Available evidence supports denial-of-service through memory allocation failure. The bundle identifies affected version ranges and the fixing commit, but provides no evidence of exploitation in the wild.

Mitigation direction

  • Upgrade to TensorFlow 2.6.0 or fixed branch releases 2.5.1, 2.4.3, or 2.3.4.
  • Audit services using tf.raw_ops.StringNGrams or wrappers for untrusted ngram_widths.
  • Until upgraded, reject negative ngram_widths before TensorFlow invocation.
  • Review the TensorFlow advisory and patch commit for branch applicability.

Validation and detection

  • Inventory TensorFlow versions in images, notebooks, training workers, and inference services.
  • Check dependency manifests for versions below 2.3.4, 2.4.0-2.4.2, or 2.5.0.
  • Search code and model pipelines for StringNGrams usage.
  • Confirm input validation prevents negative ngram_widths where the operator is used.
  • Re-run relevant ML pipeline tests after upgrading TensorFlow.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-681: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-37646 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2021-37646Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tensorflowtensorflow>= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4Listed
Weakness

CWE details

CWE-681

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-681 · source CWE mapping

Incorrect Conversion between Numeric Types

Incorrect Conversion between Numeric Types represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs