CVE-2021-37692: 
Python vulnerability analysis and mitigation

CVE-2021-37692 affects TensorFlow, an end-to-end open source platform for machine learning. The vulnerability was discovered and disclosed in July 2021, affecting TensorFlow versions < 2.6.0 and > 2.5.0. Under certain conditions, Go code could trigger a segmentation fault in string deallocation when handling string tensors with mismatched dimensions (GitHub Advisory).

The vulnerability occurs when C.TFTStringDealloc is called during garbage collection within a finalizer function for string tensors. The tensor structure isn't checked until encoding to avoid a performance penalty. The deallocation method assumes encoding succeeded but segfaults when a string tensor is garbage collected whose encoding failed, particularly due to mismatched dimensions (GitHub Advisory).

The vulnerability could lead to application crashes through segmentation faults when processing string tensors with mismatched dimensions in TensorFlow's Go implementation (GitHub Advisory).

The issue was patched in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix was included in TensorFlow 2.6.0 and was backported to TensorFlow 2.5.1. The solution defers the call to set the finalizer function until NewTensor returns, and for failed string tensor encoding, deallocs are determined based on bytes written (GitHub Advisory).