CVE-2021-29541: 
Python vulnerability analysis and mitigation

CVE-2021-29541 is a vulnerability in TensorFlow, an end-to-end open source platform for machine learning. The vulnerability was discovered in May 2021 and affects TensorFlow versions prior to 2.5.0. The issue involves a null pointer dereference vulnerability in the tf.raw_ops.StringNGrams operation (TF Advisory).

The vulnerability stems from insufficient validation of the data_splits argument in the StringNGrams operation implementation. When the output is computed to have 0 or negative size, ngrams_data becomes a null pointer. Subsequent writes to the output tensor trigger a null pointer dereference. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a null pointer dereference, potentially causing application crashes and denial of service conditions. The impact is limited to availability with no direct impact on confidentiality or integrity (TF Advisory).

The vulnerability has been patched in multiple TensorFlow versions: 2.5.0, 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users should upgrade to these patched versions. The fix was implemented in GitHub commit ba424dd8f16f7110eea526a8086f1a155f14f22b (TF Advisory).