CVE-2021-37668: TensorFlow DoS via div-by-zero

CISO Take

A local attacker can crash any TensorFlow model serving process by passing a dims tensor containing a zero value to UnravelIndex, causing an unhandled division by zero. Upgrade to TensorFlow 2.6.0, 2.5.1, 2.4.3, or 2.3.4 immediately. Shared inference environments (multi-tenant GPU clusters, Jupyter hubs) face elevated risk since 'local' access is common.

What is the risk?

Medium severity in isolated deployments; elevates to high in multi-tenant ML infrastructure where co-tenants or API users can influence model inputs. Attack complexity is trivial—no ML expertise required, just crafting a tensor with a zero-valued dim. No active exploitation evidence and no CISA KEV listing, but the 2021 vintage means many unpatched TF instances persist in legacy pipelines.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
195.8K OpenSSF 7.1 3.7K dependents Pushed 2d ago 4% patched ~1372d to patch Full package profile →

Do you use TensorFlow? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

PATCH

Upgrade TensorFlow to ≥2.6.0, or apply backports 2.5.1, 2.4.3, 2.3.4.
VALIDATE INPUTS

Add pre-execution checks ensuring no element of dims tensors equals zero before calling UnravelIndex.
ISOLATE

Run model serving in separate processes/containers per tenant to limit blast radius of crash.
MONITOR

Alert on TF process crashes or abnormal termination signals in serving infrastructure.
AUDIT

Scan internal model code and third-party models for use of tf.raw_ops.UnravelIndex with dynamic dims inputs.

How is it classified?

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0043 - Craft Adversarial Data AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art.9 - Risk management system for high-risk AI

ISO 42001

A.6.2.6 - AI system robustness and reliability

NIST AI RMF

GOVERN-1.2 - AI risk and impact inventory MANAGE-4.1 - Risk treatment and residual risk management

Frequently Asked Questions

What is CVE-2021-37668?

A local attacker can crash any TensorFlow model serving process by passing a dims tensor containing a zero value to UnravelIndex, causing an unhandled division by zero. Upgrade to TensorFlow 2.6.0, 2.5.1, 2.4.3, or 2.3.4 immediately. Shared inference environments (multi-tenant GPU clusters, Jupyter hubs) face elevated risk since 'local' access is common.

Is CVE-2021-37668 actively exploited?

No confirmed active exploitation of CVE-2021-37668 has been reported, but organizations should still patch proactively.

How to fix CVE-2021-37668?

1. PATCH: Upgrade TensorFlow to ≥2.6.0, or apply backports 2.5.1, 2.4.3, 2.3.4. 2. VALIDATE INPUTS: Add pre-execution checks ensuring no element of dims tensors equals zero before calling UnravelIndex. 3. ISOLATE: Run model serving in separate processes/containers per tenant to limit blast radius of crash. 4. MONITOR: Alert on TF process crashes or abnormal termination signals in serving infrastructure. 5. AUDIT: Scan internal model code and third-party models for use of tf.raw_ops.UnravelIndex with dynamic dims inputs.

What systems are affected by CVE-2021-37668?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, batch inference.

What is the CVSS score for CVE-2021-37668?

CVE-2021-37668 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesbatch inference

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0043 Craft Adversarial Data

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art.9

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN-1.2, MANAGE-4.1

What are the technical details?

Original Advisory

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving models using `tf.raw_ops.UnravelIndex` by triggering a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unravel_index_op.cc#L36) does not check that the tensor subsumed by `dims` is not empty. Hence, if one element of `dims` is 0, the implementation does a division by 0. We have patched the issue in GitHub commit a776040a5e7ebf76eeb7eb923bf1ae417dd4d233. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Exploitation Scenario

An attacker with access to a shared ML inference platform (e.g., internal model serving API, Jupyter notebook cluster) identifies a model endpoint that internally calls UnravelIndex. They submit a crafted inference request containing a dims tensor with a zero-valued element. TensorFlow executes the kernel without validation, performs a division by zero, and the serving process crashes. In a containerized environment without auto-restart, this results in sustained denial of service. In a Kubernetes deployment, repeated crashes can trigger CrashLoopBackOff, exhausting cluster resources.