CVE-2021-37660

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-376615.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boCVE-2021-376627.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via CVE-2021-376637.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuanCVE-2021-376647.1TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of hCVE-2021-376657.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementatiCVE-2021-376667.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binCVE-2021-376677.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binCVE-2021-376685.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in appliCVE-2021-376695.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in appliCVE-2021-37675.4bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-376705.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of hCVE-2021-376717.8TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via bin
CVE-2021-37660: Medium severity, CVSS 5.5 | Vulnix