LiveActive security incident?Get immediate response
CVE Record

CVE-2021-37657: Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. We have patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This TensorFlow flaw lets a low-privileged local attacker trigger unsafe behavior in specific matrix diagonal operations. The main business risk is disruption or incorrect behavior in machine-learning workloads where users can run TensorFlow code. Public sources list a patch and affected versions, but do not show active exploitation.

Executive priority

Treat as a high-priority patch for shared or multi-user ML environments. Single-user, isolated research systems have lower urgency, but should still update through normal dependency maintenance because the fix is available.

Technical view

CVE-2021-37657 is CWE-824 in TensorFlow MatrixDiagV* raw operations. Incomplete validation allows an empty k tensor, after which code incorrectly accesses the first element and binds a reference to a null pointer. CVSS 3.1 is 7.1 with local attack vector, low complexity, low privileges, no user interaction, and high integrity/availability impact.

Likely exposure

Exposure is most likely in TensorFlow environments running affected versions and allowing local or authenticated users to execute TensorFlow workloads. Highest-risk settings include shared ML notebooks, training platforms, CI jobs, and model-serving systems that accept user-controlled graphs or operations.

Exploitation context

The provided sources do not indicate CISA KEV listing or active exploitation. Exploitation requires the ability to invoke affected MatrixDiagV* operations on vulnerable TensorFlow versions. Impact is described as undefined behavior with integrity and availability consequences, not confidentiality loss.

Researcher notes

The evidence is strong for affected versions, root cause, and fix availability. Public sources do not provide exploit observations, broad remote exposure, or product impacts beyond TensorFlow. Avoid expanding scope without environment-specific evidence.

Mitigation direction

  • Upgrade TensorFlow to 2.6.0 or patched supported releases 2.5.1, 2.4.3, or 2.3.4.
  • If upgrade is delayed, restrict untrusted users from submitting TensorFlow graphs or raw operations.
  • Review the TensorFlow advisory and patch commit for branch-specific remediation details.
  • Prioritize shared ML platforms, notebooks, CI jobs, and model-serving runtimes.

Validation and detection

  • Inventory TensorFlow versions across containers, notebooks, training jobs, and model-serving deployments.
  • Confirm affected ranges: below 2.3.4, 2.4.0 through 2.4.2, and 2.5.0.
  • Verify patched versions are rebuilt into deployed runtime artifacts.
  • Review workload history for MatrixDiagV* related crashes, without assuming compromise.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-824: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-37657 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2021-37657Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tensorflowtensorflow>= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4Listed
Weakness

CWE details

CWE-824

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-824 · source CWE mapping

Access of Uninitialized Pointer

Access of Uninitialized Pointer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs