Detections
Analytics
SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-6p5r-g9mq-ggh2)
high Tenable Cloud Security Plugin ID 411549
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker
can cause undefined behavior via binding a reference to null pointer in all operations of type
`tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187
cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete
validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a
vector, but there is no check for the number of elements. If this is an empty tensor, then code that
accesses the first element of the tensor is wrong. We have patched the issue in GitHub commit
ff8894044dfae5568ecbf2ed514c1a37dc394f1b. The fix will be included in TensorFlow 2.6.0. We will also
cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also
affected and still in supported range. (CVE-2021-37658)
See Also
Plugin Details
Severity: High
ID: 411549
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-37658
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/11/2021
Vulnerability Publication Date: 8/11/2021
Reference Information
CVE: CVE-2021-37658
cwe: CWE-824