CVE-2021-37681: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a null pointer vulnerability in its TFLite SVDF implementation. The vulnerability, identified as CVE-2021-37681, was discovered and reported by members of the Aivul Team from Qihoo 360. The issue affects versions prior to 2.6.0, with patched versions including 2.3.4, 2.4.3, and 2.5.1 (GitHub Advisory).

The vulnerability stems from the GetVariableInput function in TFLite's SVDF implementation, which can return a null pointer. However, the GetTensorData function assumes that its argument is always a valid tensor. Additionally, since GetVariableInput calls GetMutableInput which might return nullptr, the tensor->is_variable expression can trigger a null pointer exception. This implementation flaw could lead to application crashes and potential denial of service (GitHub Advisory).

The vulnerability could result in null pointer exceptions leading to application crashes and potential denial of service in systems using the affected versions of TensorFlow (GitHub Advisory).

The issue was patched in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76 and included in TensorFlow 2.6.0. The fix was also backported to versions 2.5.1, 2.4.3, and 2.3.4. Users are recommended to upgrade to these patched versions to address the vulnerability (GitHub Advisory).