Detections
Analytics
SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-5xwc-mrhx-5g3m)
high Tenable Self-Hosted Container Security Plugin ID 411096
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker
can cause undefined behavior via binding a reference to null pointer in all operations of type
`tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb8
0d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation
that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but
there is no check for the number of elements. If this is an empty tensor, then code that accesses the
first element of the tensor is wrong. We have patched the issue in GitHub commit
f2a673bd34f0d64b8e40a551ac78989d16daad09. The fix will be included in TensorFlow 2.6.0. We will also
cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also
affected and still in supported range. (CVE-2021-37657)
See Also
Plugin Details
Severity: High
ID: 411096
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-37657
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/11/2021
Vulnerability Publication Date: 8/11/2021
Reference Information
CVE: CVE-2021-37657
cwe: CWE-824