CVE-2021-37650: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, contained a vulnerability (CVE-2021-37650) in the implementation of tf.raw_ops.ExperimentalDatasetToTFRecord and tf.raw_ops.DatasetToTFRecord functions. The vulnerability was discovered in versions prior to 2.6.0 and was reported by members of the Aivul Team from Qihoo 360 (GitHub Advisory).

The vulnerability stems from the implementation assuming all records in the dataset are of string type without performing proper type checking. When processing numeric types, this assumption could lead to heap buffer overflow and segmentation faults. The issue specifically occurs when the implementation interprets numbers as valid tstrings, which subsequently causes problems when attempting to compute the CRC of the record (GitHub Commit).

When exploited, this vulnerability could trigger heap buffer overflow and segmentation faults in the affected TensorFlow functions, potentially leading to program crashes and denial of service conditions (GitHub Advisory).

The vulnerability was patched in TensorFlow versions 2.6.0, 2.5.1, 2.4.3, and 2.3.4. The fix includes proper type checking and validation of input data types. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).