CVE-2021-37668 — MEDIUM (CVSS 5.5) AI Security Vulnerability

CISO Take

A local attacker can crash any TensorFlow model serving process by passing a dims tensor containing a zero value to UnravelIndex, causing an unhandled division by zero. Upgrade to TensorFlow 2.6.0, 2.5.1, 2.4.3, or 2.3.4 immediately. Shared inference environments (multi-tenant GPU clusters, Jupyter hubs) face elevated risk since 'local' access is common.

Risk Assessment

Medium severity in isolated deployments; elevates to high in multi-tenant ML infrastructure where co-tenants or API users can influence model inputs. Attack complexity is trivial—no ML expertise required, just crafting a tensor with a zero-valued dim. No active exploitation evidence and no CISA KEV listing, but the 2021 vintage means many unpatched TF instances persist in legacy pipelines.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed 6d ago 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

5.5 / 10

EPSS

0.0%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

PATCH

Upgrade TensorFlow to ≥2.6.0, or apply backports 2.5.1, 2.4.3, 2.3.4.
VALIDATE INPUTS

Add pre-execution checks ensuring no element of dims tensors equals zero before calling UnravelIndex.
ISOLATE

Run model serving in separate processes/containers per tenant to limit blast radius of crash.
MONITOR

Alert on TF process crashes or abnormal termination signals in serving infrastructure.
AUDIT

Scan internal model code and third-party models for use of tf.raw_ops.UnravelIndex with dynamic dims inputs.

Classification

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0043 - Craft Adversarial Data AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Art.9 - Risk management system for high-risk AI

ISO 42001

A.6.2.6 - AI system robustness and reliability

NIST AI RMF

GOVERN-1.2 - AI risk and impact inventory MANAGE-4.1 - Risk treatment and residual risk management

Frequently Asked Questions

What is CVE-2021-37668?

A local attacker can crash any TensorFlow model serving process by passing a dims tensor containing a zero value to UnravelIndex, causing an unhandled division by zero. Upgrade to TensorFlow 2.6.0, 2.5.1, 2.4.3, or 2.3.4 immediately. Shared inference environments (multi-tenant GPU clusters, Jupyter hubs) face elevated risk since 'local' access is common.

Is CVE-2021-37668 actively exploited?

No confirmed active exploitation of CVE-2021-37668 has been reported, but organizations should still patch proactively.

How to fix CVE-2021-37668?

1. PATCH: Upgrade TensorFlow to ≥2.6.0, or apply backports 2.5.1, 2.4.3, 2.3.4. 2. VALIDATE INPUTS: Add pre-execution checks ensuring no element of dims tensors equals zero before calling UnravelIndex. 3. ISOLATE: Run model serving in separate processes/containers per tenant to limit blast radius of crash. 4. MONITOR: Alert on TF process crashes or abnormal termination signals in serving infrastructure. 5. AUDIT: Scan internal model code and third-party models for use of tf.raw_ops.UnravelIndex with dynamic dims inputs.

What systems are affected by CVE-2021-37668?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, batch inference.

What is the CVSS score for CVE-2021-37668?

CVE-2021-37668 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.04%.

Technical Details

NVD Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving models using `tf.raw_ops.UnravelIndex` by triggering a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unravel_index_op.cc#L36) does not check that the tensor subsumed by `dims` is not empty. Hence, if one element of `dims` is 0, the implementation does a division by 0. We have patched the issue in GitHub commit a776040a5e7ebf76eeb7eb923bf1ae417dd4d233. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Exploitation Scenario

An attacker with access to a shared ML inference platform (e.g., internal model serving API, Jupyter notebook cluster) identifies a model endpoint that internally calls UnravelIndex. They submit a crafted inference request containing a dims tensor with a zero-valued element. TensorFlow executes the kernel without validation, performs a division by zero, and the serving process crashes. In a containerized environment without auto-restart, this results in sustained denial of service. In a Kubernetes deployment, repeated crashes can trigger CrashLoopBackOff, exhausting cluster resources.