CVE-2021-37685: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability (CVE-2021-37685) in TFLite's expand_dims.cc implementation. The vulnerability was discovered and disclosed in August 2021, affecting TensorFlow versions 2.3.0 through 2.3.4, 2.4.0 through 2.4.3, 2.5.0, and 2.6.0 release candidates (GitHub Advisory).

The vulnerability allows reading one element outside of bounds of heap allocated data. When the 'axis' parameter is provided with a large negative value (e.g., -100000), after the initial check it remains negative. The subsequent validation check passes incorrectly, leading to the for loop reading one element before the start of input_dims.data when i = 0. This results in a heap out-of-bounds read vulnerability. The issue has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (NVD).

The vulnerability allows attackers to read data outside the bounds of heap allocated memory, potentially exposing sensitive information from the application's memory space (GitHub Advisory).

The issue has been patched in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257 and included in TensorFlow 2.6.0. The fix was also backported to TensorFlow versions 2.5.1, 2.4.3, and 2.3.4. Users are recommended to upgrade to these patched versions (GitHub Advisory).