Security readout for executives and security teams
Plain-English summary
A flaw in TensorFlow’s FractionalAvgPoolGrad operation can access memory outside expected heap buffer boundaries when given an empty input. It matters most where users or workloads can run TensorFlow operations with limited privileges. The vendor patched it and named fixed releases; there is no source evidence of active exploitation.
Executive priority
Treat this as a high-priority patching issue for ML infrastructure, especially shared environments. It is not described as internet-exploitable in the provided sources, but the impact rating is high because successful abuse can affect confidentiality and integrity.
Technical view
Affected TensorFlow versions fail to validate that the input tensor to `tf.raw_ops.FractionalAvgPoolGrad` is non-empty. This can create an empty Eigen matrix map and then access it out of bounds. The advisory rates it CVSS 7.1 with local access and low privileges required.
Likely exposure
Exposure is limited to TensorFlow deployments on affected versions: 2.5.0 before 2.5.1, 2.4.x before 2.4.3, and versions before 2.3.4. Risk is higher in shared ML notebooks, pipelines, or services where low-privileged users can run TensorFlow workloads.
Exploitation context
The provided sources do not show active exploitation, and CISA KEV status is false. Exploitation requires local access and low privileges, with no user interaction. The source material does not provide evidence of remote exploitation or public weaponization.
Researcher notes
The root cause is missing validation for empty input before constructing and indexing an Eigen matrix map in the gradient kernel. The fix is identified as TensorFlow commit 0f931751fb20f565c4e94aa6df58d54a003cdb30 and was scheduled for 2.6.0 plus supported branch cherry-picks.
Mitigation direction
- Upgrade TensorFlow to 2.6.0 or a patched supported release.
- Use TensorFlow 2.5.1, 2.4.3, or 2.3.4 where those branches are required.
- Inventory ML runtimes, containers, notebooks, and batch images for affected TensorFlow versions.
- Check TensorFlow advisory guidance before relying on compensating controls.
- Prioritize shared or multi-user ML environments first.
Validation and detection
- Compare installed TensorFlow versions against the affected version ranges.
- Confirm production images rebuild with patched TensorFlow packages.
- Identify workloads using `tf.raw_ops.FractionalAvgPoolGrad` or related fractional average pooling gradients.
- Review shared ML platforms for users able to run arbitrary TensorFlow operations.
- Verify dependency lockfiles and container manifests no longer pin affected releases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-37651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N1.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hpv4-7p9c-mvfrCVE reference · x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/0f931751fb20f565c4e94aa6df58d54a003cdb30CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.