CVE-2021-37649: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability in the code for tf.raw_ops.UncompressElement that could trigger a null pointer dereference. The vulnerability was discovered in versions prior to 2.6.0 and was assigned CVE-2021-37649. The issue was reported by members of the Aivul Team from Qihoo 360 (GitHub Advisory).

The vulnerability exists in the implementation of tf.raw_ops.UncompressElement where a pointer to a CompressedElement is obtained from a Variant tensor and then dereferenced for decompressing. The code lacks proper validation to check if the Variant tensor actually contains a CompressedElement, resulting in a null pointer dereference when the pointer is nullptr. The vulnerability has a CVSS v3.1 base score of 5.5 MEDIUM according to NVD assessment (NVD).

When exploited, this vulnerability can cause a null pointer dereference, potentially leading to application crashes and denial of service conditions. The issue can be triggered by providing specific input to the tf.raw_ops.UncompressElement function (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.6.0, 2.5.1, 2.4.3, and 2.3.4. Users are recommended to upgrade to these patched versions. The fix implements proper validation by adding checks to ensure the input contains a compressed element before dereferencing (GitHub Commit).